Retention doesn't work - what's wrong ?

[mikesr]

Hi,

we configured retention policy based on the below parameters. However it doesn't work. There is no clue in the logs either.
The Splunk is running on Windows Server 2012. User of the suplunkd proces has Full Control rights to the archive DIR.
When the archive DIR was missing the frozen data were deleted along the frozenTimePeriodInSecs parameter. After adding the coldToFrozenDir parameter data are neither copied to the DIR nor deleted.
Can anyone help please.

[main]

frozenTimePeriodInSecs = 15552000

coldToFrozenDir = D:\SplunkArchive

Thanx
Roman

[datasearchninja · Accepted solution]

Are you sure that you have data that is a candidate for archive? Data is only frozen when all events in the bucket are older than the frozenTimePeriodInSecs.

[datasearchninja · Accepted solution]

Try a search like this to list the times when you would expect buckets to roll to frozen (Replacing with the index you are interested in, and the timetofrozen amount):

| dbinspect index=main | search state!="hot" | table splunk_server bucketId endEpoch | eval frozenTimePeriodInSecs = "15552000" | eval frozentime=endEpoch+frozenTimePeriodInSecs | sort frozentime | convert TIMEFORMAT="%Y-%m-%d %H:%M:%S" ctime(frozentime) as frozentime

[mikesr]

This works prety well. I can see when the next bucket will be rolled over. Currently some data has been moved to the archive.

Thanks for your help.

[datasearchninja · Accepted solution]

Are you sure that you have data that is a candidate for archive? Data is only frozen when all events in the bucket are older than the frozenTimePeriodInSecs.

[mikesr]

Not sure at all 😉 Looking that colddb dir is empty as well ... Any clue ?