Reset frozenTimePeriodInSecs

[OldManEd]

How often does Splunk check for aged data and reclaim disk space? I reset the frozenTimePeriodInSecs on an indexer from 6 years to 5 after checking that we indeed have data that old, but the disk space on the indexer has not changed.

[OldManEd]

Martin,
Thanks for pointing me to "dbinspect". I did not know about that command. As it turns out, it's not a "date" issue that I have, it's a "data size" issue.
~Ed

[martin_mueller]

By default Splunk checks every minute, see rotatePeriodInSecs.

Do you have single events that old, or do you have entire buckets that old? The key distinction is that Splunk will only prune whole buckets once the youngest event in that bucket has crossed the frozen threshold.
Use dbinspect to look at your older buckets without mucking about in the file system.

[yannK]

check the timerange of your buckets with dbinspect

To be frozen :
- the bucket cannot be hot
- all the events have to older than the frozenTimePeriodInSecs

[martin_mueller]

You can trigger freezing of buckets by data size through fiddling with maxTotalDataSizeMB.