Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- If a cold to frozen script fails, what happens?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
In indexes.conf, we can specify a value for coldToFrozenScript, to run a specific script when cold buckets are rolled to frozen.
What happens if the script fails to execute, or returns an error code, etc, when a rolling of cold buckets to frozen is triggered?
Will the cold buckets be deleted in this case?
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
According to Splunk support, if the script to roll cold buckets to frozen fails to run, the cold buckets will not be deleted.
If these cold buckets are not deleted, and new incoming data would cause the index to exceed its configured size, Splunk will not delete the cold buckets to make room. Instead, the index will grow in size till the script is fixed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
According to Splunk support, if the script to roll cold buckets to frozen fails to run, the cold buckets will not be deleted.
If these cold buckets are not deleted, and new incoming data would cause the index to exceed its configured size, Splunk will not delete the cold buckets to make room. Instead, the index will grow in size till the script is fixed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can configure deletion by age AND by size. The condition that matches first will prevail. It is possible that the second condition will never match due to the first condition.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If we had set the limit of index to a particular smaller value (say 100MB),Will Splunk overrides the value to auto and make the index size to grow ?
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
