Getting Data In

thaweddb empty

tararso
Explorer

I have configured the index.conf
homePath = C:\DB\index1\db
thawedPath = C:\DB\index1\thaweddb
frozenTimePeriodInSecs = 7776000

Based on this configuration after 90 days it should archive to thaweddb. However, the
thaweddb is empty. Any idea?

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

By default the cold to frozen policy is to delete the data.

Also the thawed path is used to "recover" archived data. So anyway you wouldn´t see any data appear here.

Regards

View solution in original post

0 Karma

gfuente
Motivator

By default the cold to frozen policy is to delete the data.

Also the thawed path is used to "recover" archived data. So anyway you wouldn´t see any data appear here.

Regards

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...