I have these settings for my index
maxTotalDataSizeMB = 100000
coldPath = C:/colddb
homePath = C:/db
coldToFrozenDir = C:/frozendb
thawedPath = C:/thaweddb
Data is not deleted as it moves to forzendb.
forzendb is now 128GB.
Not sure why this is not working as expected.
Thanks
The forzen data is not deleted automatically. It is outside the management of splunk. If deletion is necessary, it is necessary to delete it using a shell etc.
If you want to delete when freezing, do not set a coldToFrozenDir, and then data will not be moved to the frozen directory, but be deleted instead
See https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf .
The forzen data is not deleted automatically. It is outside the management of splunk. If deletion is necessary, it is necessary to delete it using a shell etc.