Getting Data In

Where are my archived files getting saved?

seema2502
Explorer

Hi Team,

i want to know where my archived files are getting saved as in my indexes.conf file "coldToFrozenDir = ".
currently we are keeping logs only for 30 days, but the team who is using Splunk need logs for at least 60 days, so i need to analyze how much data we had last month so that we can check for disk space and rest all configuration.

Thanks,
Seema

Tags (2)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi seema2502,

from the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/Automatearchiving

Caution: By default, the indexer deletes all frozen data. It removes the data from the index at the moment it becomes frozen. If you need to keep the data around, you must configure the indexer to archive the data before removing it. You do this by either setting the coldToFrozenDir attribute or specifying a valid coldToFrozenScript in indexes.conf.

You can verify with this command (on *nix) $SPLUNK_HOME/bin/splunk cmd btool indexes list | grep coldToFrozenDir if any valid directory is set or not. If not your frozen events are gone.

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi seema2502,

from the docs http://docs.splunk.com/Documentation/Splunk/6.1.4/Indexer/Automatearchiving

Caution: By default, the indexer deletes all frozen data. It removes the data from the index at the moment it becomes frozen. If you need to keep the data around, you must configure the indexer to archive the data before removing it. You do this by either setting the coldToFrozenDir attribute or specifying a valid coldToFrozenScript in indexes.conf.

You can verify with this command (on *nix) $SPLUNK_HOME/bin/splunk cmd btool indexes list | grep coldToFrozenDir if any valid directory is set or not. If not your frozen events are gone.

cheers, MuS

seema2502
Explorer

Hi Mus,

Thanks a lot for your swift response. As we have not set any specific path for coldToFrozenDir hence Splunk might have removed all the frozen files.
Regards,
Seema

0 Karma

MuS
SplunkTrust
SplunkTrust

Indeed, no directory set = frozen events removed. Please mark this as answered in this case, thx

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...