https://community.splunk.com/t5/Splunk-Search/Log-Archive/m-p/74645#M181221 <P>Yes Brian $SPLUNK_DB2_Frozen has been defined in /etc/splunk-launch.conf file.</P> Mon, 28 Sep 2020 11:25:18 GMT ssingh5 2020-09-28T11:25:18Z https://community.splunk.com/t5/Splunk-Search/Log-Archive/m-p/74643#M181219 <P>Hi,</P> <P>I am testing automatic Log Archiving for my Splunk Deployment. i am testing this on one of my single index named OS. </P> <P>For auto Archiving i have configured "coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os" the location where i want to archive the data for OS index.</P> <P>Along with that i have configured following paramenter in my customizied Indexes.conf file to test Archiving by rolling data from hot/warm/cold to frozen to check some data at my archiving location.But i coud not able to see any data in my archiving location can any one please let me know where i am worng and how should i configre this ?</P> <P>[os]<BR /> homePath = $SPLUNK_DB2/os/db<BR /> coldPath = $SPLUNK_DB2/os/colddb<BR /> thawedPath = $SPLUNK_DB2/os/thaweddb<BR /> coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os<BR /> maxHotBuckets = 5<BR /> maxHotSpanSecs = 3600<BR /> maxHotBuckets = 1<BR /> maxDataSize = 100<BR /> maxTotalDataSizeMB = 2000<BR /> frozenTimePeriodInSecs = 3600</P> Mon, 28 Sep 2020 11:25:13 GMT https://community.splunk.com/t5/Splunk-Search/Log-Archive/m-p/74643#M181219 ssingh5 2020-09-28T11:25:13Z https://community.splunk.com/t5/Splunk-Search/Log-Archive/m-p/74644#M181220 <P>Is $SPLUNK_DB2_Frozen actually defined anywhere in your environment? </P> <P>Brian</P> Mon, 28 Sep 2020 11:25:16 GMT https://community.splunk.com/t5/Splunk-Search/Log-Archive/m-p/74644#M181220 Brian_Osburn 2020-09-28T11:25:16Z https://community.splunk.com/t5/Splunk-Search/Log-Archive/m-p/74645#M181221 <P>Yes Brian $SPLUNK_DB2_Frozen has been defined in /etc/splunk-launch.conf file.</P> Mon, 28 Sep 2020 11:25:18 GMT https://community.splunk.com/t5/Splunk-Search/Log-Archive/m-p/74645#M181221 ssingh5 2020-09-28T11:25:18Z