Bucket Mover

[gudavasr]

Hi,

I upgraded splunk version from 4.3.1 to 5.0.3 and I noticed indexes are moved to frozen state.

And after Upgrade, the log shows this:
frozenTimePeriodInSecs not specified in config for index main. Defaulting to: 432000 seconds

I searched for 432000 in all my conf files but I can't find.

Now, the logs show this:

BucketMover - will attempt to freeze: /dev1_index/db/db_1373564795_1373510323_84 because frozenTimePeriodInSecs=432000 exceeds difference between now=1373996815 and latest=1373564795

I searched for 432000 but could not find anywhere. here is my frozentime configured in all indexes:

frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 7776000
frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0

Did anyone experience this? can someone help?

Thank You

[lguinn2 · Accepted solution]

The default will not appear in any configuration file. Splunk is telling you that this is the value it will use if no frozenTimePeriodInSecs is specified for an index - and that the main index does not have a frozenTimePeriodInSecs specification. You should be able to set this value for the main index by editing $SPLUNK_HOME/etc/system/local/indexes.conf and adding

[main]
frozenTimePeriodInSecs = 188697600

or whatever value you prefer.

[gudavasr]

Thank you.