Rolling over data to a a Share

[paul_1994]

I have a distributed Environment consisting of 2 SH and 2 indexers. I would like to keep around 30 days of logs on my tier 1 storage and the rest on my tier 3 storage ( \some\share). I am not sure how to configure my indexes.conf File to do so.

Current Index.conf:
[com_iislogs]

coldPath = $SPLUNK_DB\com_iislogs\colddb

homePath = $SPLUNK_DB\com_iislogs\db

thawedPath = $SPLUNK_DB\com_iislogs\thaweddb

maxTotalDataSizeMB = 450000

maxDataSize = auto_high_volume

How do I setup anything after 30 days or a certain size to move the data to \some\share

thanks

[gkanapathy · Accepted solution]

You can either move it to from "home" (tier 1) to "cold" (tier 2), or to "frozen" (tier 3). either way, you can just set homePath.maxDataSizeMB. When it is full, the data will roll to the next tier. If you aren't using "cold", you can just set coldPath.maxDataSizeMB to zero. you have set the locations of "home" and "cold", but if you would rather use "frozen" than "cold", you set that with the "coldToFrozenDir" setting.

These are documented in $SPLUNK_HOME/etc/system/README/indexes.conf or http://docs.splunk.com/Documentation/Splunk/latest/admin/indexesconf

It is worth noting that there are many settings that can limit the size of each tier (e.g., maxDataSizeMB or maxHotBuckets), so if those are small, you may need to raise them to something larger (e.g., 999999999 or something), as the smallest restriction is the one that takes effect.

[paul_1994]

Thank you sir! This is what I needed explained.