Deployment Architecture

How to move cold and frozen buckets to a new disk?

New Member

I'm looking for some direction on how to move cold and frozen buckets to a new disk. We have a single server Windows solution and need to move older logs to the second drive. What and where is the path that needs to be specified? What needs to be done on the new drive. I'd appreciate examples.

0 Karma

SplunkTrust
SplunkTrust

Hi calbree,

check out the docs about indexes.conf and set coldToFrozenScript http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Indexesconf if you don't set that option, data is deleted when rolled to frozen.

coldToFrozenScript Specifies a script to run when data will leave the splunk index system. Essentially, this implements any archival tasks before the data is deleted out of its default location.

hope this helps ...

cheers, MuS

0 Karma

New Member

Thank you for your replies. I'm looking for the actual syntax to use in the index.conf file to move the logs that have aged from drive C: to drive 😧 We only want to make this change for certain indexes.

coldPath = $SPLUNK_DB\cisco_asa\colddb
homePath = $SPLUNK_DB\cisco_asa\db
thawedPath = $SPLUNK_DB\cisco_asa\thaweddb

0 Karma

Builder

Also note that there is another simple option, like that of of using coldToFrozenScript. As mentioned in the doc shared by MuS, you can simply set coldToFrozenDir to the archive storage location, provided that it is accessible as a path and your buckets will be moved there when they get (c)older than your config specifies.

More info here too:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Configureindexstorage

SplunkTrust
SplunkTrust

HeHe, true forgot about that option 🙂

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!