Deployment Architecture

Is there a way to control the size of Frozen Buckets?

marciodcr
Engager

Hi,

I need to retain about 6 months of events (3 months of searchable data + 3 months stored on frozen data).

The frozen data will be stored in a NFS volume and i would like to know if there is a way to control the total disk space used by the frozen buckets.

The main reason is to avoid out of disk space on the NFS Volume.

Thank you!

Thanks!

Tags (3)
0 Karma

yannK
Splunk Employee
Splunk Employee

The frozen data will be stored in a NFS volume and i would like to know if there is a way to control the total disk space used by the frozen buckets.

No, the frozen buckets are considered as out of splunk, their size and volume are not monitored or controlled.
They are under the responsibility of your archive administrator to move them or rotate them to ensure disk space for the future frozen buckets,.

OL
Communicator

Hi Marciodcr,

If I'm not mistaking, the frozen buckets name will contain the epoch time (db_) the same way we have with the warm and cold buckets. therefore you could create a simple script which will check the earliest time of each bucket from the name and remove all the old one.

Does this make sense?

More information on buckets, have a look at the documentation: http://docs.splunk.com/Documentation/Splunk/6.1.3/Indexer/HowSplunkstoresindexes

Regards,
Olivier

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...