Deployment Architecture

What is the proper way to move buckets from cold to thawed?

richnavis
Contributor

Hello,

What is the proper way to move buckets from cold to thawed? From time to time, we have a reason to keep a particular days worth of data for extended periods of time. Is it ok to simply copy the bucket containing the data from colddb to thawed before it rolls off to frozen?

0 Karma

ddrillic
Ultra Champion

A related thread at How to thaw multiple DB within the Frozen bucket?

To rebuild the buckets they use -

cd /opt/splunk/var/lib/splunk/web_logging/thaweddb ; ls | xargs -i /opt/splunk/bin/splunk rebuild {}
0 Karma

richnavis
Contributor

I read that and am not sure we are trying to achieve the same thing. I'm trying to determine if it is OK to prematurely move buckets from colddb to thawed if we know we want to retain them for long periods of time, and if so, what is the proper way to do that.

0 Karma

ddrillic
Ultra Champion

The "official" procedure is to copy from the frozen bucket to the thawed one and then rebuild it. I would assume that doing it from cold to thawed wouldn't be advised. You can allow the data to reach the frozen bucket and from there you can thaw it. Maybe this way would work for you...

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...