Is it safe to delete all frozen buckets from coldToFrozenDir manually from the indexers, while the cluster is up and running?
We have one big ColdToFrozenDir, to which all frozen buckets are copied from all indexes. Since this is called an archive, I would expect that splunk doesn't care when I delete them. Is this true?
Thanks!
... View more
I have the same issue: some universal forwarders don't send the metrics.log, although it is actual and splunkd.log is send properly.
Additionally I found several forwarders, not sending all data from the configured sources of TA-nix. A restart solves the problem. But then it happens again without any apparent reason (no high system load) that data of one source are not send anymore, although other sources are still send.
... View more
Hi all,
The app Splunk Health Check Overview is really helpful. Therefore, we would like to know if it is already tested with Splunk 6.3 since we plan to update our Splunk landscape from 6.2.x to 6.3.
Thanks,
Birgit
... View more