Monitoring Splunk

How do i search indexed data in Warm Db ?

chimbudp
Contributor

splunkd.log gets indexed in _internal index.
From this index , i could able to get data for last 1 month.
I need to have splunkd.log for Jan2013 .
How do i get it ?
Was the data moved to Warm db,cold db?
If ,so how can i perform Search option against those buckets ?

Tags (2)
0 Karma
1 Solution

chris
Motivator

I'm afraid your data is not searchable in splunk anymore. The _internal index has a frozenTimePeriodInSecs of 2419200 seconds which equals to 28 days by default, if haven't configured a coldToFrozenScript for the index the data was deleted. You can change that value by overriding the default in $SPLUNK_HOME/etc/system/local/indexes.conf. Jus add a [_internal] stanza and override any settings you want. To display the current settings you can use:

/opt/splunk/bin/splunk btool indexes list _internal
[_internal]
.
..
...
frozenTimePeriodInSecs = 2419200
..
.

View solution in original post

0 Karma

chris
Motivator

I'm afraid your data is not searchable in splunk anymore. The _internal index has a frozenTimePeriodInSecs of 2419200 seconds which equals to 28 days by default, if haven't configured a coldToFrozenScript for the index the data was deleted. You can change that value by overriding the default in $SPLUNK_HOME/etc/system/local/indexes.conf. Jus add a [_internal] stanza and override any settings you want. To display the current settings you can use:

/opt/splunk/bin/splunk btool indexes list _internal
[_internal]
.
..
...
frozenTimePeriodInSecs = 2419200
..
.
0 Karma

chimbudp
Contributor

thanks Chris.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...