Getting Data In

coldToFrozenDir per index

imacdonald2
Path Finder

I was running a cold to frozen script that moved the forzen files into a separate directory per index.

/opt/splunk/bin/compressedExport.sh

( cd "$1" && gzip *.tsidx )
SPATH=`echo $1 |sed 's/^\/var\/splunk\/lib\/splunk\/\(.*\/\)db.*$/\1/'`
mkdir -p /var/splunk/archive/$SPATH
cp -r "$1" /var/splunk/archive/$SPATH  #replace this with your archive directory

So I would end up with the archives in
/var/splunk/archive/index1
/var/splunk/archive/index2
etc

Is there an easy way to do something similar with the new coldtofrozen script.

I tried setting
coldToFrozenDir = /var/splunk/archive/
but all the archive files end up in the root of the /var/splunk/archive/ directory.

Can I define coldToFrozenDir per index?

Tags (2)
0 Karma
1 Solution

imacdonald2
Path Finder

I found the answer, I looked at the
/opt/splunk/bin/coldToFrozenExample.py script and saw it has this line at the end

destdir = os.path.join(ARCHIVE_DIR, indexname, os.path.basename(bucket))

So if I use that script it will put it in /ARCHIVE_DIR/index/

So I made a copy of the script, edited it, added a new line at the top, so on unix systems it will execute as a python script

#!/opt/splunk/bin/python

and changing the ARCHIVE_DIR line at the top to

ARCHIVE_DIR = '/var/splunk/archive'

then added the following to the [default] in /opt/splunk/etc/system/local/indexes.conf

coldToFrozenScript = $SPLUNK_HOME/bin/coldToFrozen.py

Now it archives to a folder in /var/splunk/archive/indexname/

View solution in original post

0 Karma

imacdonald2
Path Finder

I found the answer, I looked at the
/opt/splunk/bin/coldToFrozenExample.py script and saw it has this line at the end

destdir = os.path.join(ARCHIVE_DIR, indexname, os.path.basename(bucket))

So if I use that script it will put it in /ARCHIVE_DIR/index/

So I made a copy of the script, edited it, added a new line at the top, so on unix systems it will execute as a python script

#!/opt/splunk/bin/python

and changing the ARCHIVE_DIR line at the top to

ARCHIVE_DIR = '/var/splunk/archive'

then added the following to the [default] in /opt/splunk/etc/system/local/indexes.conf

coldToFrozenScript = $SPLUNK_HOME/bin/coldToFrozen.py

Now it archives to a folder in /var/splunk/archive/indexname/

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...