With my index configuration for archive data, is it safe to move this folder elsewhere due to size and will the archive job continue as it hits the configured settings?

[AaronMoorcroft]

Hi Guys

I have my Index archive data as per the below index config:

[default]
frozenTimePeriodInSecs = 62899200

[_audit]
maxTotalDataSizeMB = 20000
frozenTimePeriodInSecs = 62899200
coldToFrozenDir = F:\archive\audit

[_internal]
maxTotalDataSizeMB = 20000
frozenTimePeriodInSecs = 62899200
coldToFrozenDir = F:\archive\internal

[_thefishbucket]
maxTotalDataSizeMB = 20000
frozenTimePeriodInSecs = 62899200
coldToFrozenDir = F:\archive\fishbucket

[history]
maxTotalDataSizeMB = 20000
frozenTimePeriodInSecs = 62899200
coldToFrozenDir = F:\archive\history

[main]
maxTotalDataSizeMB = 4000000
frozenTimePeriodInSecs = 62899200
coldToFrozenDir = F:\archive\main

[splunklogger]
maxTotalDataSizeMB = 20000
frozenTimePeriodInSecs = 62899200
coldToFrozenDir = F:\archive\splunklogger

[summary]
maxTotalDataSizeMB = 20000
frozenTimePeriodInSecs = 62899200
coldToFrozenDir = F:\archive\summary

So I have in the F: drive my archive folder with all the above archived data in it. What I need to know is, is it safe to move this folder elsewhere as it's getting large now and will the archive job continue to archive as it hits the above pre reqs ?

I assume that once removed, this data will no longer be available when running Splunk searches.

[chanfoli]

Frozen data is not available for searching, so think of frozen buckets as an "offline" bucket archive. The bucket data can be safely moved as it should never actually be in use, i.e. when buckets get moved to frozen directory, search can no longer see them.

Based on your above configs, if you plan to leave the directories there in F you can move the data elsewhere, or you can change the coldToFrozenDir to a new location which has space and reload the config/restart splunk on your indexer to make sure it gets picked up.

More info on coldToFrozenDir is available here:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Automatearchiving