topic Bucket Mover in Splunk Search

Bucket Mover

gudavasr — Mon, 28 Sep 2020 14:23:10 GMT

Hi,

I upgraded splunk version from 4.3.1 to 5.0.3 and I noticed indexes are moved to frozen state.

And after Upgrade, the log shows this:
frozenTimePeriodInSecs not specified in config for index main. Defaulting to: 432000 seconds

I searched for 432000 in all my conf files but I can't find.

Now, the logs show this:

BucketMover - will attempt to freeze: /dev1_index/db/db_1373564795_1373510323_84 because frozenTimePeriodInSecs=432000 exceeds difference between now=1373996815 and latest=1373564795

I searched for 432000 but could not find anywhere. here is my frozentime configured in all indexes:

frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 7776000
frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0

Did anyone experience this? can someone help?

Thank You

Re: Bucket Mover

lguinn2 — Thu, 18 Jul 2013 19:48:23 GMT

The default will not appear in any configuration file. Splunk is telling you that this is the value it will use if no frozenTimePeriodInSecs is specified for an index - and that the main index does not have a frozenTimePeriodInSecs specification. You should be able to set this value for the main index by editing $SPLUNK_HOME/etc/system/local/indexes.conf and adding

[main]
frozenTimePeriodInSecs = 188697600

or whatever value you prefer.

Re: Bucket Mover

gudavasr — Thu, 18 Jul 2013 20:24:34 GMT

Thank you.