Splunk Search

What will break if I set coldPath to /dev/null?


I've been asked to size a Splunk installation with only 30 days of hot/warm data - no cold data. I've never heard of this before. I could probably set coldPath=/dev/null so warm data is deleted instead of being moved to cold, but can Splunk handle that?

If this reply helps you, Karma would be appreciated.
0 Karma


Just set maxTotalDataSizeMB and homePath.maxDataSizeMB to the same amount. No need for shenanigans with the locations.

maxTotalDataSizeMB     = 100000
homePath.maxDataSizeMB = 100000
frozenTimePeriodInSecs = 2592000
  • edit - added your 30 day limit
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...