Deployment Architecture

What is the difference between frozen bucket and thawed bucket?

Madhan45
Path Finder

What is the difference between frozen bucket and thawed bucket?
Can any one explain or share the link?

Tags (3)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust
Frozen: Data rolled from cold. The indexer deletes frozen data by default, but you can choose to archive it instead. Archived data can later be thawed.

Thawed: Data restored from an archive. If you archive frozen data, you can later return it to the index by thawing it. 

Link: http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/HowSplunkstoresindexes

View solution in original post

pushpakchowdary
New Member

What is xee

0 Karma

javiergn
SplunkTrust
SplunkTrust
Frozen: Data rolled from cold. The indexer deletes frozen data by default, but you can choose to archive it instead. Archived data can later be thawed.

Thawed: Data restored from an archive. If you archive frozen data, you can later return it to the index by thawing it. 

Link: http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/HowSplunkstoresindexes

Madhan45
Path Finder

Thanks. For example the setting frozenTimePeriodInSecs=15552000 (that is 180 days) in indexes.conf will keep the data for 180 days after that it will send to frozen. That means the indexed data will be deleted after 180 days, is my understanding correct?

0 Karma

javiergn
SplunkTrust
SplunkTrust

Yes, that is correct. If you don't tell your indexer you want to archive your frozen data it will delete it permanently.

Take a look at this: http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Setaretirementandarchivingpolicy#Archive_d...

And this:
http://docs.splunk.com/Documentation/Splunk/6.4.0/Indexer/Automatearchiving

0 Karma

Madhan45
Path Finder

Thanks....

0 Karma

javiergn
SplunkTrust
SplunkTrust

No worries.
If you are happy with the answer please mark it as answered so that others can benefit from it.

Thanks,
J

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...