Hello, I'm trying to configure my indexes to store frozen buckets on an NFS share mounted to the Splunk Server. I have mounted the share, created a path with sub folders for each index.
I've set this and let it ride.
I went to check the data on the NFS share and there is nothing in the NFS Share path.
Is there something else I'm missing here?
Yes, I have coldToFrozenDir set for each index in $SPLUNKHOME/apps/search/local/indexes.conf. Is there something else I'm missing?
Verify Splunk has write access to the frozen dir.
Check splunkd.log for errors.
directory access has been confirmed. Only reference to coldToFrozenDir states that both coldToFrozenScript and coldToFrozenScript are set and coldToFrozenDir will take precedence.
As mentioned by richgalloway, you have to add the configuration path for "coldToFrozenDir" at indexes.conf not at inputs.conf.
check this link here for further information
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Configureindexstorage#Attributes_that_aff...
See below a sample of configuration for "coldToFrozenDir" parameter setup at indexes.conf
[web]
homePath = volume:primary/web/db
coldPath = volume:primary/web/colddb
thawedPath = $SPLUNK_DB/web/thaweddb
coldToFrozenDir = /opt/frozen/web
Have you set coldToFrozenDir
in indexes.conf?