Getting Data In

Reset frozenTimePeriodInSecs

OldManEd
Builder

How often does Splunk check for aged data and reclaim disk space? I reset the frozenTimePeriodInSecs on an indexer from 6 years to 5 after checking that we indeed have data that old, but the disk space on the indexer has not changed.

0 Karma

OldManEd
Builder

Martin,
Thanks for pointing me to "dbinspect". I did not know about that command. As it turns out, it's not a "date" issue that I have, it's a "data size" issue.
~Ed

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

By default Splunk checks every minute, see rotatePeriodInSecs.

Do you have single events that old, or do you have entire buckets that old? The key distinction is that Splunk will only prune whole buckets once the youngest event in that bucket has crossed the frozen threshold.
Use dbinspect to look at your older buckets without mucking about in the file system.

0 Karma

yannK
Splunk Employee
Splunk Employee

check the timerange of your buckets with dbinspect

To be frozen :
- the bucket cannot be hot
- all the events have to older than the frozenTimePeriodInSecs

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can trigger freezing of buckets by data size through fiddling with maxTotalDataSizeMB.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...