Archive
Highlighted

Bucket Mover

Path Finder

Hi,

I upgraded splunk version from 4.3.1 to 5.0.3 and I noticed indexes are moved to frozen state.

And after Upgrade, the log shows this:
frozenTimePeriodInSecs not specified in config for index main. Defaulting to: 432000 seconds

I searched for 432000 in all my conf files but I can't find.

Now, the logs show this:

BucketMover - will attempt to freeze: /dev1index/db/db1373564795137351032384 because frozenTimePeriodInSecs=432000 exceeds difference between now=1373996815 and latest=1373564795

I searched for 432000 but could not find anywhere. here is my frozentime configured in all indexes:

frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 7776000
frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0

Did anyone experience this? can someone help?

Thank You

Highlighted

Re: Bucket Mover

Legend

The default will not appear in any configuration file. Splunk is telling you that this is the value it will use if no frozenTimePeriodInSecs is specified for an index - and that the main index does not have a frozenTimePeriodInSecs specification. You should be able to set this value for the main index by editing $SPLUNK_HOME/etc/system/local/indexes.conf and adding

[main]
frozenTimePeriodInSecs = 188697600

or whatever value you prefer.

View solution in original post

Highlighted

Re: Bucket Mover

Path Finder

Thank you.

0 Karma