On my test environement I configured and index like this:
[prove_di_cold]
homePath = /root/splunk_hot/prove_di_cold/db
coldPath = /root/splunk_cold/prove_di_cold/colddb
thawedPath = /root/splunk_cold/prove_di_cold/thaweddb
maxWarmDBCount=1
maxDataSize = 1000
maxHotSpanSecs = 40
frozenTimePeriodInSecs = 100
rotatePeriodInSecs = 60
bucketRebuildMemoryHint = 0
coldToFrozenDir = /root/splunk_frozen/prove_di_cold
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair = 1
enableTsidxReduction = 0
minHotIdleSecsBeforeForceRoll = 0
rtRouterQueueSize =
rtRouterThreads =
suspendHotRollByDeleteQuery = 0
syncMeta = 1
But splunk never copy any data from hot/warm path to cold or freeze path
Have you got any other information about it?
Thanks
splunk wont roll the data until the bucket is full. its possible your hot bucket(s) arent full to even roll to warm even if the maxHotSpanSecs = 40
is set.
try setting this maxHotBuckets=x
to a lower integer default is 3.
https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Indexesconf
splunk wont roll the data until the bucket is full. its possible your hot bucket(s) arent full to even roll to warm even if the maxHotSpanSecs = 40
is set.
try setting this maxHotBuckets=x
to a lower integer default is 3.
https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Indexesconf
check with btool which settings are being applied.
./splunk btool indexes list --debug prove_di_cold
Weird because you have frozenTimePeriodInSecs = 100