Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Bucket Mover
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I upgraded splunk version from 4.3.1 to 5.0.3 and I noticed indexes are moved to frozen state.
And after Upgrade, the log shows this:
frozenTimePeriodInSecs not specified in config for index main. Defaulting to: 432000 seconds
I searched for 432000 in all my conf files but I can't find.
Now, the logs show this:
BucketMover - will attempt to freeze: /dev1_index/db/db_1373564795_1373510323_84 because frozenTimePeriodInSecs=432000 exceeds difference between now=1373996815 and latest=1373564795
I searched for 432000 but could not find anywhere. here is my frozentime configured in all indexes:
frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 7776000
frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0
Did anyone experience this? can someone help?
Thank You
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The default will not appear in any configuration file. Splunk is telling you that this is the value it will use if no frozenTimePeriodInSecs is specified for an index - and that the main index does not have a frozenTimePeriodInSecs specification. You should be able to set this value for the main index by editing $SPLUNK_HOME/etc/system/local/indexes.conf and adding
[main]
frozenTimePeriodInSecs = 188697600
or whatever value you prefer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The default will not appear in any configuration file. Splunk is telling you that this is the value it will use if no frozenTimePeriodInSecs is specified for an index - and that the main index does not have a frozenTimePeriodInSecs specification. You should be able to set this value for the main index by editing $SPLUNK_HOME/etc/system/local/indexes.conf and adding
[main]
frozenTimePeriodInSecs = 188697600
or whatever value you prefer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster
What's New in Splunk Enterprise Security 8.8 and Beyond
A Four-Part Event Series: State of Observability - Where AI Meets Performance
