Deployment Architecture

Splunk Index Not able to go to Cold Storage

Ealderiso
Explorer

We have a splunk index that is not properly moving to cold storage. We are just looking for some troubleshooting steps. We are trying to find where the Cold Path is defined for indexes by default. Our other indexes are moving to /var/splunk-cold/ however this one index is not moving its cold data here.

Where can we define where cold storage goes for an index?

Tags (1)

ddrillic
Ultra Champion

As @maciep said, the definitions are under indexes.conf

By default we have -

[hatch]

homePath   = $SPLUNK_DB/hatchdb/db
coldPath   = $SPLUNK_DB/hatchdb/colddb
thawedPath = $SPLUNK_DB/hatchdb/thaweddb
maxDataSize = 10000
maxHotBuckets = 10

For each index, a colddb directory exists under the index main directory.

0 Karma

maciep
Champion

The cold path would be defined in indexes.conf. But you might be better off using btool to get the settings for that index:

splunk btool indexes list [your index name]

But out of curiosity are you saying that the data is being deleted instead of rolling to cold? Or is it remaining warm? Or something else? Knowing what's happening might allow to provide more specific troubleshooting steps.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...