- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Retention doesn't work - what's wrong ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
we configured retention policy based on the below parameters. However it doesn't work. There is no clue in the logs either.
The Splunk is running on Windows Server 2012. User of the suplunkd proces has Full Control rights to the archive DIR.
When the archive DIR was missing the frozen data were deleted along the frozenTimePeriodInSecs parameter. After adding the coldToFrozenDir parameter data are neither copied to the DIR nor deleted.
Can anyone help please.
[main]
frozenTimePeriodInSecs = 15552000
coldToFrozenDir = D:\SplunkArchive
Thanx
Roman
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you sure that you have data that is a candidate for archive? Data is only frozen when all events in the bucket are older than the frozenTimePeriodInSecs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try a search like this to list the times when you would expect buckets to roll to frozen (Replacing with the index you are interested in, and the timetofrozen amount):
| dbinspect index=main | search state!="hot" | table splunk_server bucketId endEpoch | eval frozenTimePeriodInSecs = "15552000" | eval frozentime=endEpoch+frozenTimePeriodInSecs | sort frozentime | convert TIMEFORMAT="%Y-%m-%d %H:%M:%S" ctime(frozentime) as frozentime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try a search like this to list the times when you would expect buckets to roll to frozen (Replacing with the index you are interested in, and the timetofrozen amount):
| dbinspect index=main | search state!="hot" | table splunk_server bucketId endEpoch | eval frozenTimePeriodInSecs = "15552000" | eval frozentime=endEpoch+frozenTimePeriodInSecs | sort frozentime | convert TIMEFORMAT="%Y-%m-%d %H:%M:%S" ctime(frozentime) as frozentime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This works prety well. I can see when the next bucket will be rolled over. Currently some data has been moved to the archive.
Thanks for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you sure that you have data that is a candidate for archive? Data is only frozen when all events in the bucket are older than the frozenTimePeriodInSecs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not sure at all 😉 Looking that colddb dir is empty as well ... Any clue ?
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
