To validate the data aging and searching on PowerFlex rack, following steps have been performed:
- Generated 50 GB of log data and forwarded it using universal forwarder to Splunk cluster. The following figure illustrates the size of the log data:
- Data is moved to indexer from the universal forwarder. The processed data is stored in the hot bucket path of indexer/data/splunk/homedb as shown in the following figure:
- Validated the indexer events present in the indexer by running a search query on hot bucket data using search head (GUI) as shown in the following figure:
- After 30-days hot/warm retention, observed that data moved from warm bucket to cold bucket path /data/splunk/isilon_colddb as shown in the following figure:
The cold bucket path /data/splunk/isilon_colddb is mounted to Indexer VM using Isilon NFS. For more information about Isilon NFS configuration, see Configure Isilon NFS for the PowerFlex rack.