Hi Team,
i want to know where my archived files are getting saved as in my indexes.conf file "coldToFrozenDir = ".
currently we are keeping logs only for 30 days, but the team who is using Splunk need logs for at least 60 days, so i need to analyze how much data we had last month so that we can check for disk space and rest all configuration.
Thanks,
Seema
Hi seema2502,
from the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/Automatearchiving
Caution: By default, the indexer deletes all frozen data. It removes the data from the index at the moment it becomes frozen. If you need to keep the data around, you must configure the indexer to archive the data before removing it. You do this by either setting the coldToFrozenDir
attribute or specifying a valid coldToFrozenScript
in indexes.conf.
You can verify with this command (on *nix) $SPLUNK_HOME/bin/splunk cmd btool indexes list | grep coldToFrozenDir
if any valid directory is set or not. If not your frozen events are gone.
cheers, MuS
Hi seema2502,
from the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/Automatearchiving
Caution: By default, the indexer deletes all frozen data. It removes the data from the index at the moment it becomes frozen. If you need to keep the data around, you must configure the indexer to archive the data before removing it. You do this by either setting the coldToFrozenDir
attribute or specifying a valid coldToFrozenScript
in indexes.conf.
You can verify with this command (on *nix) $SPLUNK_HOME/bin/splunk cmd btool indexes list | grep coldToFrozenDir
if any valid directory is set or not. If not your frozen events are gone.
cheers, MuS
Hi Mus,
Thanks a lot for your swift response. As we have not set any specific path for coldToFrozenDir hence Splunk might have removed all the frozen files.
Regards,
Seema
Indeed, no directory set = frozen events removed. Please mark this as answered in this case, thx