Getting Data In

Reset frozenTimePeriodInSecs

Builder

How often does Splunk check for aged data and reclaim disk space? I reset the frozenTimePeriodInSecs on an indexer from 6 years to 5 after checking that we indeed have data that old, but the disk space on the indexer has not changed.

0 Karma

Builder

Martin,
Thanks for pointing me to "dbinspect". I did not know about that command. As it turns out, it's not a "date" issue that I have, it's a "data size" issue.
~Ed

0 Karma

SplunkTrust
SplunkTrust

By default Splunk checks every minute, see rotatePeriodInSecs.

Do you have single events that old, or do you have entire buckets that old? The key distinction is that Splunk will only prune whole buckets once the youngest event in that bucket has crossed the frozen threshold.
Use dbinspect to look at your older buckets without mucking about in the file system.

0 Karma

Splunk Employee
Splunk Employee

check the timerange of your buckets with dbinspect

To be frozen :
- the bucket cannot be hot
- all the events have to older than the frozenTimePeriodInSecs

0 Karma

SplunkTrust
SplunkTrust

You can trigger freezing of buckets by data size through fiddling with maxTotalDataSizeMB.

0 Karma