Getting Data In

Can we delete frozen data in Splunk?

pratapa
Explorer

Recently we encountered a problem. /opt file system on the indexer server has reached 100% due to which users were unable to do search.

we found that /opt/splunk/archive/main folder is consuming most of the disk space (499 GB out of 500 GB). This is the folder which contains frozen data. Please find the below line in the configuration of main index in indexes.conf

coldToFrozenDir = /opt/splunk/archive/main

[main]
coldPath = $SPLUNK_DB/defaultdb/colddb
bucketRebuildMemoryHint = 0
compressRawdata = 1
syncMeta = 1
frozenTimePeriodInSecs = 15552000
enableOnlineBucketRepair = 1
homePath = $SPLUNK_DB/defaultdb/db
enableDataIntegrityControl = 0
coldToFrozenDir = /opt/splunk/archive/main
thawedPath = $SPLUNK_DB/defaultdb/thaweddb
enableTsidxReduction = 0
maxTotalDataSizeMB = 50000

Can we delete frozen data?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @pratapa ,

You accepted this answer during the closing period, so your acceptance wasn'r recorded, could you accept it again?

Ciao.

Giuseppe

View solution in original post

0 Karma

Mehran_Safari
Explorer

hi 

https://github.com/mehransafari/Splunk_Frozen_Cleanup

this is a script tha will find frozen logs older than X days and will ask you to remove them if you want 

it may help you

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pratapa
you can delete frozen data without any problem obiviously you no longer have that data.
If you're not interested to these data, why don't you delete them after retention time instead copying them in frozen dir?

Ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pratapa ,

You accepted this answer during the closing period, so your acceptance wasn'r recorded, could you accept it again?

Ciao.

Giuseppe

0 Karma

493669
Super Champion

Yes you can always delete frozen data in splunk as in splunk frozen data is not searchable.
But in your case it seems it's not frozen data which occupying space (499 GB out of 500 GB) because 500GB space is considered for hot+warm and cold storage and not frozen storage.
So I think your space under $SPLUNK_DB/defaultdb/ (colddb or db) is getting 499GB full.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...