Hello, I'm trying to configure my indexes to store frozen buckets on an NFS share mounted to the Splunk Server. I have mounted the share, created a path with sub folders for each index.
I've set this and let it ride.
I went to check the data on the NFS share and there is nothing in the NFS Share path.
Is there something else I'm missing here?
As mentioned by richgalloway, you have to add the configuration path for "coldToFrozenDir" at indexes.conf not at inputs.conf.
check this link here for further information
See below a sample of configuration for "coldToFrozenDir" parameter setup at indexes.conf
homePath = volume:primary/web/db
coldPath = volume:primary/web/colddb
thawedPath = $SPLUNK_DB/web/thaweddb
coldToFrozenDir = /opt/frozen/web