What is the best practice for moving frozen data into a bigger disk without losing any data?

[saurabh0912]

Hi,
We are reaching 100% of disk space for frozen data.
I wanted to know how can we move data to a bigger disk without turning off Splunkindexers?

[nickhills · Accepted solution]

Frozen data is invisible to Splunk.

You can just move it to a new location without any additional process.

Splunk only tracks Hot/Warm, Cold, and thawed data.
Frozen data is essentially considered "offline" or "archived" - Its up to you how you manage it.

[saurabh0912]

I will be swapping disks, therefore for brief time there won't be any disk available to splunk for frozen data. Will it cause any issue if Splunk couldn't find the disk to place the frozen data for some time.

[nickhills]

No - If the frozen path is not available, buckets will not move to the frozen path.

You do not want to keep it in this condition for too long, but once the frozen volume is mounted, freezing will resume from where it left off.

See: https://answers.splunk.com/answers/287056/if-my-coldtofrozendir-is-full-or-unavailable-do-i.html

[saurabh0912]

Got it.
if i have to keep this in long(2-3 days) condition, should I calculate the data ingestion per day and add that much disk space to colddata disk as temp solution?

[nickhills]

It depends how much data you have that will roll from cold to frozen in that time.

You could look at the files in your frozen dir with a modified time in the last 3 days, and add up the total size on disk for a total. This would give you an estimate based on history.

However, if your daily ingest is 10Gb a day, you would probably be pretty safe with some fag packet maths:

Daily ingest (10Gb) x 3 (days) + 30% = ~40Gb

[saurabh0912]

Thanks, will try same.