index setting

[dall]

hi In my index i have added this things

 [ind1]

homePath= $SPLUNK_DB/ind1/db

coldPath= $SPLUNK_DB/ind1/colddb

thawedPath= $SPLUNK_DB/ind1/thaweddb

maxHotBuckets=10

maxDataSize=10000

maxWarmDBCount=300

maxTotalDataSizeMB=200000

frozenTimePeriodInSecs=31536000

 coldToFrozenDir=$SPLUNK_DB/ ind1/frozendb

that means after 1 year data will be deleted ??

if i ll not add volume for this it ll affect my index or what???

please help on this

[scelikok]

Yes, both are correct @dall .

Also keep in mind if you restart the indexer hot buckets will roll to warm. So you may have some buckets that have less than 10 GB. But this will not change frozen process.

[scelikok]

Hi @dall,

Since you defined coldToFrozenDir old data will not be deleted but move to coldToFrozenDir path.

Retention mechanism works according to two parameters. maxTotalDataSizeMB and frozenTimePeriodInSecs . Whichever hits first indexer will move oldest raw data to coldToFrozenDir path. It means if your index size goes over 200 GB before 1 year, raw data will be moved to coldToFrozenDir.

You should better change coldToFrozenDir to another disk or NFS path, because you will not free space.

If this reply helps you an upvote is appreciated.

[dall]

if we ll not set coldtofrozendir data ll not move to that path and that ll deleted directly ??

or if ll mention that path that means that ll create a folder externally ??