Splunk Index Not able to go to Cold Storage

[Ealderiso]

We have a splunk index that is not properly moving to cold storage. We are just looking for some troubleshooting steps. We are trying to find where the Cold Path is defined for indexes by default. Our other indexes are moving to /var/splunk-cold/ however this one index is not moving its cold data here.

Where can we define where cold storage goes for an index?

[ddrillic]

As @maciep said, the definitions are under indexes.conf

By default we have -

[hatch]

homePath   = $SPLUNK_DB/hatchdb/db
coldPath   = $SPLUNK_DB/hatchdb/colddb
thawedPath = $SPLUNK_DB/hatchdb/thaweddb
maxDataSize = 10000
maxHotBuckets = 10

For each index, a colddb directory exists under the index main directory.

[maciep]

The cold path would be defined in indexes.conf. But you might be better off using btool to get the settings for that index:

splunk btool indexes list [your index name]

But out of curiosity are you saying that the data is being deleted instead of rolling to cold? Or is it remaining warm? Or something else? Knowing what's happening might allow to provide more specific troubleshooting steps.