/ opt / splunk / var / lib / splunk / cold

[isabelcarvajal]

Hello

I like you help with validate what contain the Filesystem / opt / splunk / var / lib / splunk / cold, indicator wha it is used 100%.

thanks.

[isabelcarvajal]

Hello

If / opt / splunk / var / lib / splunk / cold, the indicator is used 100%, can it cause problems in some splunk functionality?

thanks

[PowerPacked]

Hi @isabelcarvajal

/ opt / splunk / var / lib / splunk -- filesystem holds data for all indexes like _internal, _introspection,_audit, main.

in each of these indexes, the data again is arranged based on the age ----- Hot, warm, cold, thawed

db folder ----- hot &warm data
colddb ----- cold data
thaweddb ----- restore frozen data which can be searched.

Please go through these doc for more understanding.
http://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/HowSplunkstoresindexes

& aging of the data can be explained in this doc.

https://wiki.splunk.com/Deploy:BucketRotationAndRetention

thanks

[isabelcarvajal]

Hello, I have one Question.

If this file system can be affected the operation of splunk?

Thanks for your answer

[PowerPacked]

what do you mean by affected ?