My coldtofrozen script seems to hang splunk, what can I do?

[jrodman]

When my selected coldToFrozenScript runs, which can take 10 minutes, the splunk search interface stops working until the script finishes, what gives?

[jrodman · Accepted solution]

In splunk v3.x and early versions of 4.0.x, the splunkd blocks nearly entirely while the coldToFrozenScript is running. In current 4.0.x, splunkd does not block for these.

Therefore your remedies are:

• Upgrade
• Modify your script to finish rapidly

I recommend a quick-finishing script in any event (such as mv bucket /dir), where you post-process the data in a manner that can be interrupted safely. A once-launched script can be quite difficult to create to work safely regarding unintended downtime.