Deployment Architecture

Splunk Index Not able to go to Cold Storage

Ealderiso
Explorer

We have a splunk index that is not properly moving to cold storage. We are just looking for some troubleshooting steps. We are trying to find where the Cold Path is defined for indexes by default. Our other indexes are moving to /var/splunk-cold/ however this one index is not moving its cold data here.

Where can we define where cold storage goes for an index?

Tags (1)

ddrillic
Ultra Champion

As @maciep said, the definitions are under indexes.conf

By default we have -

[hatch]

homePath   = $SPLUNK_DB/hatchdb/db
coldPath   = $SPLUNK_DB/hatchdb/colddb
thawedPath = $SPLUNK_DB/hatchdb/thaweddb
maxDataSize = 10000
maxHotBuckets = 10

For each index, a colddb directory exists under the index main directory.

0 Karma

maciep
Champion

The cold path would be defined in indexes.conf. But you might be better off using btool to get the settings for that index:

splunk btool indexes list [your index name]

But out of curiosity are you saying that the data is being deleted instead of rolling to cold? Or is it remaining warm? Or something else? Knowing what's happening might allow to provide more specific troubleshooting steps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...