How to move cold and frozen buckets to a new disk?

[calbree]

I'm looking for some direction on how to move cold and frozen buckets to a new disk. We have a single server Windows solution and need to move older logs to the second drive. What and where is the path that needs to be specified? What needs to be done on the new drive. I'd appreciate examples.

[MuS]

Hi calbree,

check out the docs about indexes.conf and set coldToFrozenScript http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Indexesconf if you don't set that option, data is deleted when rolled to frozen.

coldToFrozenScript Specifies a script to run when data will leave the splunk index system. Essentially, this implements any archival tasks before the data is deleted out of its default location.

hope this helps ...

cheers, MuS

[calbree]

Thank you for your replies. I'm looking for the actual syntax to use in the index.conf file to move the logs that have aged from drive C: to drive 😧 We only want to make this change for certain indexes.

coldPath = $SPLUNK_DB\cisco_asa\colddb
homePath = $SPLUNK_DB\cisco_asa\db
thawedPath = $SPLUNK_DB\cisco_asa\thaweddb

[chanfoli]

Also note that there is another simple option, like that of of using coldToFrozenScript. As mentioned in the doc shared by MuS, you can simply set coldToFrozenDir to the archive storage location, provided that it is accessible as a path and your buckets will be moved there when they get (c)older than your config specifies.

More info here too:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Configureindexstorage

[MuS]

HeHe, true forgot about that option 🙂