Deployment Architecture

How to move cold and frozen buckets to a new disk?

calbree
New Member

I'm looking for some direction on how to move cold and frozen buckets to a new disk. We have a single server Windows solution and need to move older logs to the second drive. What and where is the path that needs to be specified? What needs to be done on the new drive. I'd appreciate examples.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi calbree,

check out the docs about indexes.conf and set coldToFrozenScript http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/Indexesconf if you don't set that option, data is deleted when rolled to frozen.

coldToFrozenScript Specifies a script to run when data will leave the splunk index system. Essentially, this implements any archival tasks before the data is deleted out of its default location.

hope this helps ...

cheers, MuS

0 Karma

calbree
New Member

Thank you for your replies. I'm looking for the actual syntax to use in the index.conf file to move the logs that have aged from drive C: to drive 😧 We only want to make this change for certain indexes.

coldPath = $SPLUNK_DB\cisco_asa\colddb
homePath = $SPLUNK_DB\cisco_asa\db
thawedPath = $SPLUNK_DB\cisco_asa\thaweddb

0 Karma

chanfoli
Builder

Also note that there is another simple option, like that of of using coldToFrozenScript. As mentioned in the doc shared by MuS, you can simply set coldToFrozenDir to the archive storage location, provided that it is accessible as a path and your buckets will be moved there when they get (c)older than your config specifies.

More info here too:

http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Configureindexstorage

MuS
SplunkTrust
SplunkTrust

HeHe, true forgot about that option 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...