Getting Data In

Why are frozen buckets not going to frozen path?

New Member

Hello, I'm trying to configure my indexes to store frozen buckets on an NFS share mounted to the Splunk Server. I have mounted the share, created a path with sub folders for each index.

I've set this and let it ride.

I went to check the data on the NFS share and there is nothing in the NFS Share path.

Is there something else I'm missing here?

0 Karma

New Member

Yes, I have coldToFrozenDir set for each index in $SPLUNKHOME/apps/search/local/indexes.conf. Is there something else I'm missing?

0 Karma

SplunkTrust
SplunkTrust

Verify Splunk has write access to the frozen dir.
Check splunkd.log for errors.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

directory access has been confirmed. Only reference to coldToFrozenDir states that both coldToFrozenScript and coldToFrozenScript are set and coldToFrozenDir will take precedence.

0 Karma

Builder

As mentioned by richgalloway, you have to add the configuration path for "coldToFrozenDir" at indexes.conf not at inputs.conf.

check this link here for further information
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Configureindexstorage#Attributes_that_aff...

See below a sample of configuration for "coldToFrozenDir" parameter setup at indexes.conf
[web]
homePath = volume:primary/web/db
coldPath = volume:primary/web/colddb
thawedPath = $SPLUNK_DB/web/thaweddb
coldToFrozenDir = /opt/frozen/web

0 Karma

SplunkTrust
SplunkTrust

Have you set coldToFrozenDir in indexes.conf?

---
If this reply helps you, an upvote would be appreciated.
0 Karma