Splunk Search

Updated indexes.conf and now there is no data for old days data from splunk search result?

ashiq1993
Loves-to-Learn

Hello All,

 

I have updated the indexes.conf file homePath.maxDataSizeMB  from 13gb to 30gb & maxTotalDataSizeMB 13gb to 30gb.And after that from search result i am not able to see old days data.Can anyone provide information how to check and fix this by getting old data in splunk?

indexes.conf file values now:

#aws_riskinfo
[aws_riskinfo]
homePath = volume:hotwarm/aws_riskinfo/db
coldPath = volume:hotwarm/aws_riskinfo/colddb
thawedPath = /prod/appli_is/splunk_indexes/archives/ARCH1Y/aws_riskinfo/thaweddb
homePath.maxDataSizeMB = 30000
coldPath.maxDataSizeMB = 0
maxTotalDataSizeMB = 30000
maxWarmDBCount = 4294967295
frozenTimePeriodInSecs = 7776000
#maxDataSize = auto_high_volume
coldToFrozenDir = /prod/appli_is/splunk_indexes/archives/ARCH1Y/aws_riskinfo/frozen

0 Karma

ashiq1993
Loves-to-Learn

Any knowledge available to fix this case?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...