Deployment Architecture

coldtofrozen script on linux doesnt work

Starlette
Contributor

My coldtofrozenscript on linux is totaly ignored, I tweaked the indexes.conf (a few warmbuckets and small total index) and the data is nicely deleted from cold....

How can I see why the coldtofrozen script isnt working?

Configed exactly like the manual,,,

[<index>]
coldToFrozenScript = /opt/splunk/bin/compressedExport.sh

in

compressedExport.sh I only set the path to the archivelocation

Tags (1)
0 Karma

Starlette
Contributor
#!/bin/sh
# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved. Version 4.0
# Edit this script to reflect your archive directory and save as
# compressedExport.sh

( cd "$1" && gzip *.tsidx )

cp -r "$1" /opt/fl_virtual_san 

you mean a test dir instead of a file right? I'have made dir /opt/foo for testing and ran:

/opt$ /opt/splunk/bin/compressedExport.sh /opt/foo

#!/bin/sh
# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved. Version 4.0
# Edit this script to reflect your archive directory and save as
# compressedExport.sh

( cd "$1" && gzip *.tsidx )

cp -r "$1" /opt/fl_virtual_san 

*** /opt/foo: directory ***

No files anywhere?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Shouldn't be, since the ( ... ) indicates the cd happens in a subshell, so the next command doesn't go to the directory. Furthermore, the path should be absolute for the cp command, so it shouldn't matter. The error indicates that it cp won't copy because /opt/foo is a directory. -r should deal with that. That error message does look strange, and I'm not sure which command is generating it.

0 Karma

tedder
Communicator

I think your problem is that you cd into the directory, then you try to copy the directory from the wrong location. Change it to this:
gzip $1/*tsidx
cp -r $1 /opt/fl_virtual_san/

0 Karma

tedder
Communicator

What are the contents of compressedExport.sh? Can you verify that it is executable? Also, try running that script by hand under the same user as splunk:

touch /tmp/foo
/opt/splunk/bin/compressedExport.sh /tmp/foo
0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...