splitting /splunk/frozen volume

[splunkdeploy]

Hi,

In my environment we have so many index servers Eg:8 idx servers.
All servers are mounted with one nfs volume called /splunk which has 11TB.
/splunk mount point contain hot ,cold, warm and frozen.

No as we have some space issue, we need to separate frozen from the /splunk volume.
We have got one new nfs volume with 10TB for /splunk/frozen.
Now the query is if I need to separate the frozen from the old volume, i can mount it separately and copy old data.But do i need to make any changes in any of the splunk configuration?

Please suggest here.

Regards,
Unni TN

[yannK]

You can use the coldtofrozendir setup, in indexes.conf

To avoid duplicates buckets, I recommend to create a new destination frozen folder for each pair or indexer/index.
It will also make it easier to restore.
(do not dump all in the same folder, it will be a nightmare)

[alacercogitatus]

So wait, what?

1. You have 8 servers mounted to a SINGLE 11TB NFS Mount?
2. What are the server specs of the indexers?
3. How are you transitioning from cold to frozen? Homebrew script? Shuttl?

[splunkdeploy]

Hi,

1.You have 8 servers mounted to a SINGLE 11TB NFS Mount?
yes, I have 8 diff. servers mounted to 11TB. 11TB mount name in /splunk and it has hot , cold and frozen.
Inside /splunk/frozen i have diff. 8 server name.

2.What are the server specs of the indexers?
All 8 servers have, 8 CPU and 16GB Memory.

1. How are you transitioning from cold to frozen? Homebrew script? Shuttl? When i have checked indexes.conf file i could see frozen transition has designed as

coldToFrozenDir = /splunk/frozen/$HOSTNAME

Regards,
Unni TN

[yannK]

use a folder per index and indexer.
coldToFrozenDir = /splunk/frozen/servername/indexname

[somesoni2]

FYR, Answer for 3 can be found by checking the value of attribute "coldToFrozenDir" OR "coldToFrozenScript" from indexes.conf file on Indexer server.