Hi,
I upgraded splunk version from 4.3.1 to 5.0.3 and I noticed indexes are moved to frozen state.
And after Upgrade, the log shows this:
frozenTimePeriodInSecs not specified in config for index main. Defaulting to: 432000 seconds
I searched for 432000 in all my conf files but I can't find.
Now, the logs show this:
BucketMover - will attempt to freeze: /dev1_index/db/db_1373564795_1373510323_84 because frozenTimePeriodInSecs=432000 exceeds difference between now=1373996815 and latest=1373564795
I searched for 432000 but could not find anywhere. here is my frozentime configured in all indexes:
frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 7776000
frozenTimePeriodInSecs = 188697600
frozenTimePeriodInSecs = 604800
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 2419200
frozenTimePeriodInSecs = 0
Did anyone experience this? can someone help?
Thank You
The default will not appear in any configuration file. Splunk is telling you that this is the value it will use if no frozenTimePeriodInSecs
is specified for an index - and that the main
index does not have a frozenTimePeriodInSecs
specification. You should be able to set this value for the main index by editing $SPLUNK_HOME/etc/system/local/indexes.conf
and adding
[main]
frozenTimePeriodInSecs = 188697600
or whatever value you prefer.
The default will not appear in any configuration file. Splunk is telling you that this is the value it will use if no frozenTimePeriodInSecs
is specified for an index - and that the main
index does not have a frozenTimePeriodInSecs
specification. You should be able to set this value for the main index by editing $SPLUNK_HOME/etc/system/local/indexes.conf
and adding
[main]
frozenTimePeriodInSecs = 188697600
or whatever value you prefer.
Thank you.