Knowledge Management

If my coldToFrozenDir is full or unavailable, do I lose my old data?

faol
Explorer

From can I see, Splunk continues to run but I would like to know what happens to the cold data which meets the criteria to be frozen? Once the frozen directory is made accessible, does Splunk continue to freeze the data, or was it already removed from the index?

0 Karma

bpaul_splunk
Splunk Employee
Splunk Employee

What occurs is the following.

  1. The script to move data to the frozen directory is run.
  2. There is no space to copy the data, or access is not available. This is logged in splunkd.log under the BucketMover category. The message will look something like the following. ERROR BucketMover - aborting move because recursive copy from src='/opt/splunk/var/lib/splunk/_internaldb/db/db_1435901691_1435696540_1132' to dst='/tmp/test/inflight-db_1435901691_1435696540_1132' failed (reason='Permission denied')
  3. The cold bucket is not removed.
  4. Once the issue preventing the script from freezing your data is resolved, the normal freezing process will resume.

If no action is taken to resolve the issue, the disk will eventually fill up and all indexing will stop.

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...