Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- After Thawing Data, how do you "Re-Freeze" it?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I have tested thawing data with good results. My question is - How do you refreeze it after you are done reviewing the data?
At this point, I'm just looking for general direction.
Many thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The thawed data is not affected by the retention period of the index, hence it will not go off automatically. You'd have to manually move them from thaweddb directory to your frozen directory.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To refreeze thawed data move it out of the thaw directory.
Documentation in indexes.conf confirms this: http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/indexesconf
Move to bucket Frozen directory.
Remove files except for the rawdata directory, since rawdata contains all the facts in the bucket.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The thawed data is not affected by the retention period of the index, hence it will not go off automatically. You'd have to manually move them from thaweddb directory to your frozen directory.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just a question though , the data in thaweddb is uncompressed whereas the data in frozen is compressed (Just a journal.gz file) so If I move the data from thaweddb to frozen ,will it be compressed after a while or not . Also , should I move or Copy . I was thinking to copy it and once finished ,delete all data in Thawed db. Please advise .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That makes perfect sense - Thank you!
Splunk Search APIを使えば調査過程が残せます
Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...
Congratulations to the 2025-2026 SplunkTrust!
