Deployment Architecture

How to move cold and frozen buckets to a new disk?

calbree
New Member

I'm looking for some direction on how to move cold and frozen buckets to a new disk. We have a single server Windows solution and need to move older logs to the second drive. What and where is the path that needs to be specified? What needs to be done on the new drive. I'd appreciate examples.

0 Karma

MuS
Legend

Hi calbree,

check out the docs about indexes.conf and set coldToFrozenScript http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Indexesconf if you don't set that option, data is deleted when rolled to frozen.

coldToFrozenScript Specifies a script to run when data will leave the splunk index system. Essentially, this implements any archival tasks before the data is deleted out of its default location.

hope this helps ...

cheers, MuS

calbree
New Member

Thank you for your replies. I'm looking for the actual syntax to use in the index.conf file to move the logs that have aged from drive C: to drive 😧 We only want to make this change for certain indexes.

coldPath = $SPLUNK_DB\cisco_asa\colddb
homePath = $SPLUNK_DB\cisco_asa\db
thawedPath = $SPLUNK_DB\cisco_asa\thaweddb

0 Karma

chanfoli
Builder

Also note that there is another simple option, like that of of using coldToFrozenScript. As mentioned in the doc shared by MuS, you can simply set coldToFrozenDir to the archive storage location, provided that it is accessible as a path and your buckets will be moved there when they get (c)older than your config specifies.

More info here too:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Configureindexstorage

MuS
Legend

HeHe, true forgot about that option 🙂

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...