The environment is standalone and installed splunk on D:drive. For particular index declared the db location in F:drive for hot and warm buckets and the cold db location is I:drive. The retention policy as 90 days .
In the indexes.conf the setting are as below.
[ssh_res_ss]
frozenTimePeriodInSecs = 7776000
maxwarmDBCount = 3
disabled = 0
coldPath = I:\splunk\ssh_res_ss\colddb
HomePath = F:\splunk\ssh_res_ss\db
thawedPath = F:\splunk\ssh_res_ss\thaweddb
↧