Why has data archiving stopped after archiving only two buckets?

[p_gurav]

Hi,

I have data more than 2 years old in Splunk. I want to archive data which is older than 18 months to AWS s3 buckets.
For this I add following settings in indexes.conf:

frozenTimePeriodInSecs = epoch for 6 months
coldToFrozenDir = path to the s3 buckets

But still archiving has been stopped after archiving two buckets. There is no error in _internal logs.

Could anybody please help in this?

[PPape]

Could you check the timestamps of your buckets?
Only Buckets in wich ALL Data is older than the frozenTimePeriodInSecs are archived.

If you have large buckets over a huge timespan this could take a while.

Maybe you could take a look at the maxHotSpanSecs parameter for the future.