When does splunk roll data from warm to cold?

[robertosegantin]

On my test environement I configured and index like this:

[prove_di_cold]
homePath = /root/splunk_hot/prove_di_cold/db
coldPath = /root/splunk_cold/prove_di_cold/colddb
thawedPath = /root/splunk_cold/prove_di_cold/thaweddb
maxWarmDBCount=1
maxDataSize = 1000
maxHotSpanSecs = 40
frozenTimePeriodInSecs = 100
rotatePeriodInSecs = 60
bucketRebuildMemoryHint = 0
coldToFrozenDir = /root/splunk_frozen/prove_di_cold
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair = 1
enableTsidxReduction = 0
minHotIdleSecsBeforeForceRoll = 0
rtRouterQueueSize =
rtRouterThreads =
suspendHotRollByDeleteQuery = 0
syncMeta = 1

But splunk never copy any data from hot/warm path to cold or freeze path

Have you got any other information about it?

Thanks

[CarsonZa · Accepted solution]

splunk wont roll the data until the bucket is full. its possible your hot bucket(s) arent full to even roll to warm even if the maxHotSpanSecs = 40 is set.

try setting this maxHotBuckets=x to a lower integer default is 3.

https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Indexesconf

[diogofgm]

check with btool which settings are being applied.

./splunk btool indexes list --debug prove_di_cold

[ddrillic]

Weird because you have frozenTimePeriodInSecs = 100