Getting Data In

How to configure coldToFrozenDir in indexes.conf on multiple indexers to archive indexed data?

locose
Path Finder

So let’s say I have 2 or 3 indexers and I configure the coldToFrozenDir in the indexes.conf…

[default]
maxWarmDBCount = 200
frozenTimePeriodInSecs = 432000
rotatePeriodInSecs = 30
coldToFrozenDir = "myAmason_server_mount/myfrozenarchive"

Do you do this on each of the indexers or should I do something like this

Indexer1

[default]
maxWarmDBCount = 200
frozenTimePeriodInSecs = 432000
rotatePeriodInSecs = 30
coldToFrozenDir = "myAmason_server_mount/myfrozenarchive/index_1"

Indexer2

[default]
maxWarmDBCount = 200
frozenTimePeriodInSecs = 432000
rotatePeriodInSecs = 30
coldToFrozenDir = "myAmason_server_mount/myfrozenarchive/index_2"

Indexer3

[default]
maxWarmDBCount = 200
frozenTimePeriodInSecs = 432000
rotatePeriodInSecs = 30
coldToFrozenDir = "myAmason_server_mount/myfrozenarchive/index_3"

I wasn’t sure if the indexer data files would step on each other if I send all the data using coldToFrozenDir option to the same path. i.e "myAmason_server_mount/myfrozenarchive"

0 Karma

ephemeric
Contributor

Hi,

I needed to know the same answer so I setup Splunk 6.4.8 and tested. To my dismay all buckets from all indexes got to your coldToFrozenDir as db_*.

Tried:
coldToFrozenDir = /media/archive/splunk/$_index_name
but it created
/media/archive/splunk/\$_index_name/

Lame.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...