[my_index] coldPath = volume:primary/my_index/colddb homePath = volume:primary/my_index/db thawedPath = $SPLUNK_DB/my_index/thaweddb frozenTimePeriodInSecs = 31536000 maxTotalDataSizeMB = 1000000
As per above configuration, data should be retained for 1 year if it does not exceed the maximum size (976.56 GB ) of the bucket.
Is this right?
hey, yes you are right
As per the doc
maxTotalDataSizeMB = <nonnegative integer> * The maximum size of an index (in MB). * If an index grows larger than the maximum size, the oldest data is frozen. * This parameter only applies to hot, warm, and cold buckets. It does not apply to thawed buckets. * Highest legal value is 4294967295 * Defaults to 500000. frozenTimePeriodInSecs = <nonnegative integer> * Number of seconds after which indexed data rolls to frozen. * If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen. * IMPORTANT: Every event in the DB must be older than frozenTimePeriodInSecs before it will roll. Then, the DB will be frozen the next time splunkd checks (based on rotatePeriodInSecs attribute). * Highest legal value is 4294967295 * Defaults to 188697600 (6 years).
Have a look at this doc for more info.
let me know if this helps!
-- if it does not exceed the maximum size (976.56 GB ) of bucket
of the index...
And/or there has not been set coldPath.maxDataSizeMB something else than 0. And of course there are enough space on device.
You could check those values from cmd line:
splunk btool indexes my_index [--debug]