Hi all!
Ive got a strange problem with data loss,but not all - its just for a peroid of time.
Here is example of my index:
coldPath = $SPLUNK_DB/myindex/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = /mnt/db/myindex/db
maxTotalDataSizeMB = 35840
thawedPath = $SPLUNK_DB/myindex/thaweddb
frozenTimePeriodInSecs = 15552000
bucketRebuildMemoryHint = 0
compressRawdata = 1
enableOnlineBucketRepair = 1
minHotIdleSecsBeforeForceRoll = 0
rtRouterQueueSize =
rtRouterThreads =
suspendHotRollByDeleteQuery = 0
syncMeta = 1
archiver.enableDataArchive = 0
Now I can see information at 21.02. and next one starts at 02.03 ,but ive seen that information was there for all week before today.
What can it be? Ive already checked bucketmover - nothing much,2 buckets deleted but with infromation from long ago.
... View more