Do I need to specify or create each index folder/bucket when doing coldToFrozen at the new location or is it automatically created?
Actually, I had to include it for each index to have them in their separate folders. Specifying it in the default puts everything in one folder
You can create global settings as
[default] coldToFrozenDir =
Splunk will automatically create the subfolders according to the index.
OR
Try running coldtofrozen script and change the directory path. Refer to this link: https://answers.splunk.com/answers/38825/coldtofrozendir-per-index.html
Actually, I had to include it for each index to have them in their separate folders. Specifying it in the default puts everything in one folder.
