Monitoring Splunk

How do i search indexed data in Warm Db ?

chimbudp
Contributor

splunkd.log gets indexed in _internal index.
From this index , i could able to get data for last 1 month.
I need to have splunkd.log for Jan2013 .
How do i get it ?
Was the data moved to Warm db,cold db?
If ,so how can i perform Search option against those buckets ?

Tags (2)
0 Karma
1 Solution

chris
Motivator

I'm afraid your data is not searchable in splunk anymore. The _internal index has a frozenTimePeriodInSecs of 2419200 seconds which equals to 28 days by default, if haven't configured a coldToFrozenScript for the index the data was deleted. You can change that value by overriding the default in $SPLUNK_HOME/etc/system/local/indexes.conf. Jus add a [_internal] stanza and override any settings you want. To display the current settings you can use:

/opt/splunk/bin/splunk btool indexes list _internal
[_internal]
.
..
...
frozenTimePeriodInSecs = 2419200
..
.

View solution in original post

0 Karma

chris
Motivator

I'm afraid your data is not searchable in splunk anymore. The _internal index has a frozenTimePeriodInSecs of 2419200 seconds which equals to 28 days by default, if haven't configured a coldToFrozenScript for the index the data was deleted. You can change that value by overriding the default in $SPLUNK_HOME/etc/system/local/indexes.conf. Jus add a [_internal] stanza and override any settings you want. To display the current settings you can use:

/opt/splunk/bin/splunk btool indexes list _internal
[_internal]
.
..
...
frozenTimePeriodInSecs = 2419200
..
.
0 Karma

chimbudp
Contributor

thanks Chris.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...