Deployment Architecture

Splunk Index Not able to go to Cold Storage

Ealderiso
Explorer

We have a splunk index that is not properly moving to cold storage. We are just looking for some troubleshooting steps. We are trying to find where the Cold Path is defined for indexes by default. Our other indexes are moving to /var/splunk-cold/ however this one index is not moving its cold data here.

Where can we define where cold storage goes for an index?

Tags (1)

ddrillic
Ultra Champion

As @maciep said, the definitions are under indexes.conf

By default we have -

[hatch]

homePath   = $SPLUNK_DB/hatchdb/db
coldPath   = $SPLUNK_DB/hatchdb/colddb
thawedPath = $SPLUNK_DB/hatchdb/thaweddb
maxDataSize = 10000
maxHotBuckets = 10

For each index, a colddb directory exists under the index main directory.

0 Karma

maciep
Champion

The cold path would be defined in indexes.conf. But you might be better off using btool to get the settings for that index:

splunk btool indexes list [your index name]

But out of curiosity are you saying that the data is being deleted instead of rolling to cold? Or is it remaining warm? Or something else? Knowing what's happening might allow to provide more specific troubleshooting steps.

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...