Archiving all indexes after 1 year

[heathramos]

I am trying to set up archiving but I can't seem to get it working.

From the docs I've read, I thought I just need to create a indexes.conf file, place it within system/local and include a line referring to coldToFrozenDir and frozenTimePeriodInSecs .

I tried that for one index and if I restart Splunk, the service won't start back up again unless I delete that file.

How exactly do I set this up?

[s2_splunk · Accepted solution]

If Splunk doesn't restart because of indexes.conf issues, it should give you some error messages in $SPLUNK_HOME\var\run\splunk\splunkd.log during startup (given your example, I am assuming you are running on Windows)
It would be helpful to see what is being logged.

My best guess is the quotes in your directory, which probably prevent resolution of the env. variable.

[heathramos]

changed the path and restarted splunk

got the following error:

ERROR loader - Problem parsing indexes.conf: Cannot load IndexConfig: Cannot create index 'windows': path of coldToFrozenDir must be absolute ('"d:\Splunk_Archive\windows"')

[heathramos]

looks like getting rid of the quotes completely worked

thanks

[s2_splunk]

Thank you for closing the loop!

[richgalloway]

If your problem is resolved, please accept the answer to help future readers.

[somesoni2]

It may be crashing due to wrong configs (indexes.conf is an important configuration file). Make sure you update the config file correctly. See this links for details on those properties.
https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Setaretirementandarchivingpolicy
https://docs.splunk.com/Documentation/Splunk/6.6.2/Indexer/Automatearchiving

[heathramos]

What should be in that config file?

My file contains the following:

[windows]
coldToFrozenDir = "$SPLUNK_DB\windows\frozendb"
frozenTimePeriodInSecs = 31536000

[somesoni2]

Try putting hardcoded path (full path) in coldToFrozenDir attribute.