Splunk Search

Log Archive

ssingh5
Path Finder

Hi,

I am testing automatic Log Archiving for my Splunk Deployment. i am testing this on one of my single index named OS.

For auto Archiving i have configured "coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os" the location where i want to archive the data for OS index.

Along with that i have configured following paramenter in my customizied Indexes.conf file to test Archiving by rolling data from hot/warm/cold to frozen to check some data at my archiving location.But i coud not able to see any data in my archiving location can any one please let me know where i am worng and how should i configre this ?

[os]
homePath = $SPLUNK_DB2/os/db
coldPath = $SPLUNK_DB2/os/colddb
thawedPath = $SPLUNK_DB2/os/thaweddb
coldToFrozenDir = $SPLUNK_DB2_Frozen/Archive/os
maxHotBuckets = 5
maxHotSpanSecs = 3600
maxHotBuckets = 1
maxDataSize = 100
maxTotalDataSizeMB = 2000
frozenTimePeriodInSecs = 3600

Tags (1)
0 Karma

Brian_Osburn
Builder

Is $SPLUNK_DB2_Frozen actually defined anywhere in your environment?

Brian

0 Karma

ssingh5
Path Finder

Yes Brian $SPLUNK_DB2_Frozen has been defined in /etc/splunk-launch.conf file.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...