Log Archive

[ssingh5]

Hi,

I am testing automatic Log Archiving for my Splunk Deployment. i am testing this on one of my single index named OS.

For auto Archiving i have configured "coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os" the location where i want to archive the data for OS index.

Along with that i have configured following paramenter in my customizied Indexes.conf file to test Archiving by rolling data from hot/warm/cold to frozen to check some data at my archiving location.But i coud not able to see any data in my archiving location can any one please let me know where i am worng and how should i configre this ?

[os]
homePath = $SPLUNK_DB2/os/db
coldPath = $SPLUNK_DB2/os/colddb
thawedPath = $SPLUNK_DB2/os/thaweddb
coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os
maxHotBuckets = 5
maxHotSpanSecs = 3600
maxHotBuckets = 1
maxDataSize = 100
maxTotalDataSizeMB = 2000
frozenTimePeriodInSecs = 3600

[Brian_Osburn]

Is $SPLUNK_DB2_Frozen actually defined anywhere in your environment?

Brian

[ssingh5]

Yes Brian $SPLUNK_DB2_Frozen has been defined in /etc/splunk-launch.conf file.