Splunk Search

Log Archive

ssingh5
Path Finder

Hi,

I am testing automatic Log Archiving for my Splunk Deployment. i am testing this on one of my single index named OS.

For auto Archiving i have configured "coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os" the location where i want to archive the data for OS index.

Along with that i have configured following paramenter in my customizied Indexes.conf file to test Archiving by rolling data from hot/warm/cold to frozen to check some data at my archiving location.But i coud not able to see any data in my archiving location can any one please let me know where i am worng and how should i configre this ?

[os]
homePath = $SPLUNK_DB2/os/db
coldPath = $SPLUNK_DB2/os/colddb
thawedPath = $SPLUNK_DB2/os/thaweddb
coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os
maxHotBuckets = 5
maxHotSpanSecs = 3600
maxHotBuckets = 1
maxDataSize = 100
maxTotalDataSizeMB = 2000
frozenTimePeriodInSecs = 3600

Tags (1)
0 Karma

Brian_Osburn
Builder

Is $SPLUNK_DB2_Frozen actually defined anywhere in your environment?

Brian

0 Karma

ssingh5
Path Finder

Yes Brian $SPLUNK_DB2_Frozen has been defined in /etc/splunk-launch.conf file.

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...