Reporting

How can we catch costly frozenTimePeriodInSecs typos?

ddrillic
Ultra Champion

Some of our production indexes were configured to have frozenTimePeriodInSecs = 777600 instead of frozenTimePeriodInSecs = 7776000, meaning, instead of 90 days they were configured to 9 days, which the client didn't like one bit when they found it.

What type of safeguards can we place to avoid such errors?

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

We have an alert that runs a few times in day to check if any index has data less than 90days and if so, we get an alert. We got bitten, when the admin deleted the buckets by mistake and had to put this alert to capture similar issues [ so, we can recover old data from backup etc..]

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

We have an alert that runs a few times in day to check if any index has data less than 90days and if so, we get an alert. We got bitten, when the admin deleted the buckets by mistake and had to put this alert to capture similar issues [ so, we can recover old data from backup etc..]

0 Karma

ddrillic
Ultra Champion

Absolutely @lakshman239 - that's the way to go !!!

0 Karma

adonio
Ultra Champion

I agree with the SE, seen it happen in the past.
double check your configurations, triple check indexes.conf

ddrillic
Ultra Champion

Sales Engineer is saying -

-- Configured is configured. No safeguards from a Splunk perspective.

Measure twice, cut once, have others review your changes.

0 Karma

Anam
Community Manager
Community Manager

Hi @ddrillic
Did the answer by @adonio help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...