Cold rolling to frozen when it shouldn't?

[twinspop]

My $SPLUNK_HOME/etc/system/local/indexes.conf is below. Apparently I'm missing something because cold archives are being dumped even though cold storage is currently only at 2 GB and /opt/splunk/var/lib/splunk/defaultdb is at 11 GB. Shouldn't maxTotalDataSizeMB and frozenTimePeriodInSecs be determining when cold storage rolls to frozen? Why is it being ignored?

[default]
maxTotalDataSizeMB = 10000

[main]
coldPath = /syslog/splunk_archives
maxTotalDataSizeMB = 150000
maxHotBuckets = 10
maxDataSize = 500
# most warm buckets we can have is 30 =~ 15 GB
maxWarmDBCount = 30
# roll cold to frozen after 1 year
frozenTimePeriodInSecs = 31536000

# for summary index
[lgn-stats]
homePath = $SPLUNK_DB/lgn-stats/db
thawedPath = $SPLUNK_DB/lgn-stats/thaweddb
coldPath = $SPLUNK_DB/lgn-stats/colddb
maxTotalDataSizeMB = 1000

I've promised the pointy-haired boss types we'd have at least 90 days of logs available, if not much more. I have 29 days and a LOT of empty disk space. Doh!

Thanks, jon

[twinspop · Accepted solution]

Support walked through a bunch of troubleshooting on this, only to find.... my syslog nightly maintenance script had a careless find command that included the Splunk Cold DB. That script was removing files every night. ARRG!

Thanks Splunk support dudes, Josh and Octavio, for being patient and helpful.