Hi,
I upgraded splunk version from 4.3.1 to 5.0.3 and I noticed indexes are moved to frozen state.
And after Upgrade, the log shows this: frozenTimePeriodInSecs not specified in config for index main. Defaulting to: 432000 seconds
I searched for 432000 in all my conf files but I can't find.
Now, the logs show this:
BucketMover - will attempt to freeze: /dev1_index/db/db_1373564795_1373510323_84 because frozenTimePeriodInSecs=432000 exceeds difference between now=1373996815 and latest=1373564795
I searched for 432000 but could not find anywhere. here is my frozentime configured in all indexes:
frozenTimePeriodInSecs = 188697600 frozenTimePeriodInSecs = 604800 frozenTimePeriodInSecs = 2419200 frozenTimePeriodInSecs = 2419200 frozenTimePeriodInSecs = 0 frozenTimePeriodInSecs = 2419200 frozenTimePeriodInSecs = 2419200 frozenTimePeriodInSecs = 7776000 frozenTimePeriodInSecs = 188697600 frozenTimePeriodInSecs = 604800 frozenTimePeriodInSecs = 2419200 frozenTimePeriodInSecs = 2419200 frozenTimePeriodInSecs = 0
Did anyone experience this? can someone help?
Thank You