Frozen: Data rolled from cold. The indexer deletes frozen data by default, but you can choose to archive it instead. Archived data can later be thawed.
Thawed: Data restored from an archive. If you archive frozen data, you can later return it to the index by thawing it.
Link: http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/HowSplunkstoresindexes
What is xee
Frozen: Data rolled from cold. The indexer deletes frozen data by default, but you can choose to archive it instead. Archived data can later be thawed.
Thawed: Data restored from an archive. If you archive frozen data, you can later return it to the index by thawing it.
Link: http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/HowSplunkstoresindexes
Thanks. For example the setting frozenTimePeriodInSecs=15552000 (that is 180 days) in indexes.conf will keep the data for 180 days after that it will send to frozen. That means the indexed data will be deleted after 180 days, is my understanding correct?
Yes, that is correct. If you don't tell your indexer you want to archive your frozen data it will delete it permanently.
Take a look at this: http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Setaretirementandarchivingpolicy#Archive_d...
And this:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Automatearchiving
Thanks....
No worries.
If you are happy with the answer please mark it as answered so that others can benefit from it.
Thanks,
J