Hi,
I need to retain about 6 months of events (3 months of searchable data + 3 months stored on frozen data).
The frozen data will be stored in a NFS volume and i would like to know if there is a way to control the total disk space used by the frozen buckets.
The main reason is to avoid out of disk space on the NFS Volume.
Thank you!
Thanks!
The frozen data will be stored in a NFS volume and i would like to know if there is a way to control the total disk space used by the frozen buckets.
No, the frozen buckets are considered as out of splunk, their size and volume are not monitored or controlled.
They are under the responsibility of your archive administrator to move them or rotate them to ensure disk space for the future frozen buckets,.
Hi Marciodcr,
If I'm not mistaking, the frozen buckets name will contain the epoch time (db_
Does this make sense?
More information on buckets, have a look at the documentation: http://docs.splunk.com/Documentation/Splunk/6.1.3/Indexer/HowSplunkstoresindexes
Regards,
Olivier