Getting Data In

After Thawing Data, how do you "Re-Freeze" it?

TheJagoff
Communicator

Hello,

I have tested thawing data with good results. My question is - How do you refreeze it after you are done reviewing the data?

At this point, I'm just looking for general direction.

Many thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The thawed data is not affected by the retention period of the index, hence it will not go off automatically. You'd have to manually move them from thaweddb directory to your frozen directory.

View solution in original post

jmpreidy
Engager

To refreeze thawed data move it out of the thaw directory.
Documentation in indexes.conf confirms this: http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/indexesconf
Move to bucket Frozen directory.
Remove files except for the rawdata directory, since rawdata contains all the facts in the bucket.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The thawed data is not affected by the retention period of the index, hence it will not go off automatically. You'd have to manually move them from thaweddb directory to your frozen directory.

ssubhani
Explorer

Just a question though , the data in thaweddb is uncompressed whereas the data in frozen is compressed (Just a journal.gz file) so If I move the data from thaweddb to frozen ,will it be compressed after a while or not . Also , should I move or Copy . I was thinking to copy it and once finished ,delete all data in Thawed db. Please advise .

TheJagoff
Communicator

That makes perfect sense - Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...