Deployment Architecture

cold path not exis

hazem
Path Finder

hello all,

 

we have multi-site cluster master and  we do not want a cold mount in the DR indexers.

is it applicable?

 

If  indexer  hits hot/warm retention and not found the cold path will delete the data  ?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The coldPath setting must be defined and the location must exist.  It's not possible (and not advised to try) to have a different configuration for the "DR" indexers.

To avoid using the cold path, create a script that deletes buckets and define it as the warmToColdScript for the index(es).   You also could assign the coldPath to a volume and make that volume large enough for a single bucket so cold buckets are frozen almost immediately.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...