Splunk Search

how to archive

jmp13
Explorer

I am reading up on how to archive and set the frozen bucket. Do i need to create my own indexes.conf file ? One is not in the system/local directory.

[default]
maxWarmDBCount = 200
frozenTimePeriodInSecs = 432000
rotatePeriodInSecs = 30
coldToFrozenDir = "$SPLUNK_HOME\myfrozenarchive"
This is in the example file. What is maxWarmDBCount and rotatePeriodInSecs? These are not in the documenation. Do I need to change default to index? My data is grown and i want to archive it.

Tags (1)
0 Karma

lukejadamec
Super Champion

Yes. Splunk does not create files in the local directory unless it is copying them from a previous install. If you create an empty indexes.conf file in the local directory, and then put in the modifications you want, then those modifications will take precedence over those in the default directory. And, they will be preserved if you upgrade Splunk in the future.

The attributes you mention are in the documentation. Perhaps you're looking at an older version? Look here, and you will see them. If you are using an older version then change the version number in the upper right dropdown:

http://docs.splunk.com/Documentation/Splunk/6.0.1/admin/Indexesconf

0 Karma

lukejadamec
Super Champion

Also, all events in the bucket must be older than the frozenTimePeriodsInSeconds, and if the default\indexes.conf specifies a value at the index level then the value you set at the default level will not work. Index level settings take precedence over default level settings.

0 Karma

lukejadamec
Super Champion

What do you mean it does not start?
The coldToFrozenDir is an index level attribute. I don't think it can be set at the default level, and even if you could I doubt you want to because it would save all indexes including the internal ones.
Set the coldtoFrozenDir in a index level stanza, for example to set the value for the main index:
[default]
frozenTimePeriodInSecs = 31104000
[main]
coldToFrozenDir = "e:archine"

0 Karma

jmp13
Explorer

I entered in the indexes.conf file
[default]
frozenTimePeriodInSecs = 31104000
coldToFrozenDir = "e:\archine"

put this in the system\local directory then restart splunk and it does not start. Is there something I am missing that I need to do? I followed the documentation so I do i need more than that in the file?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...