Deployment Architecture

Is there a way to control the size of Frozen Buckets?

marciodcr
Engager

Hi,

I need to retain about 6 months of events (3 months of searchable data + 3 months stored on frozen data).

The frozen data will be stored in a NFS volume and i would like to know if there is a way to control the total disk space used by the frozen buckets.

The main reason is to avoid out of disk space on the NFS Volume.

Thank you!

Thanks!

Tags (3)
0 Karma

yannK
Splunk Employee
Splunk Employee

The frozen data will be stored in a NFS volume and i would like to know if there is a way to control the total disk space used by the frozen buckets.

No, the frozen buckets are considered as out of splunk, their size and volume are not monitored or controlled.
They are under the responsibility of your archive administrator to move them or rotate them to ensure disk space for the future frozen buckets,.

OL
Communicator

Hi Marciodcr,

If I'm not mistaking, the frozen buckets name will contain the epoch time (db_) the same way we have with the warm and cold buckets. therefore you could create a simple script which will check the earliest time of each bucket from the name and remove all the old one.

Does this make sense?

More information on buckets, have a look at the documentation: http://docs.splunk.com/Documentation/Splunk/6.1.3/Indexer/HowSplunkstoresindexes

Regards,
Olivier

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...