aws, redhat, splunk smartstore

AWS Notes.md

@@ -201,7 +201,7 @@ AWS_PROFILE=dps_prod aws ec2 describe-instances |
 
 ### AWS Instance Scheduler in TEST
 
-Test Ec2 instances get shutdown at night. This is accomplished via a lambda application. To prevent an EC2 instance from getting shutdown, just remove the Schedule tag.
+Test Ec2 instances get shutdown at night. This is accomplished via a cloudformation template that is configured in Terragrunt. To prevent an EC2 instance from getting shutdown, just remove the Schedule tag.
 
 ## Fixing bad volume tags
 

RedHat Full Drive Notes.md

@@ -45,11 +45,14 @@ rm -rf hosted_agg01k*.gz
 
 aws-syslog1-tts.nga.gov / nga-splunk-syslog-1
 salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/* |sort -h'
+#Old Logs
 salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/old_logs/* |sort -h'
 salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/old_logs/fortigate/* |sort -h'
-salt nga-splunk-syslog-1 cmd.run 'rm -rf /opt/syslog-ng/old_logs/fortigate/2020-01-10/*' --out=txt
-salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/old_logs/netscaler/* |sort -h'
+salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/old_logs/fortigate/*/*/* |sort -h'
+salt nga-splunk-syslog-1 cmd.run 'rm -rf /opt/syslog-ng/old_logs/fortigate/aws-syslog1-tts.nga.gov/log/*' --out=txt
+salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/old_logs/netscaler/*/*/* |sort -h'
 salt nga-splunk-syslog-1 cmd.run 'rm -rf /opt/syslog-ng/old_logs/netscaler/2020-01-10/*' --out=txt
+#Current Logs
 salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/fortigate/* |sort -h'
 salt nga-splunk-syslog-1 cmd.run 'du -sh /opt/syslog-ng/fortigate/aws-syslog1-tts.nga.gov/log/* |sort -h'
 salt nga-splunk-syslog-1 cmd.run 'rm -rf /opt/syslog-ng/fortigate/aws-syslog1-tts.nga.gov/log/2020-01-26/*' --out=txt

Splunk Smartstore Thaw Notes.md

@@ -148,4 +148,8 @@ Just do a rolling restart?
 
 ## Datamodel Acceleration
 
-Please note that restoring the data will not add it to the current datamodels. Once the data is restored, Splunk will start accelerating the data assuming it is configured to do so and the restored data includes data that is configured to be accelerated. 
+Please note that restoring the data will not add it to the current datamodels. Once the data is restored, Splunk will start accelerating the data assuming it is configured to do so and the restored data includes data that is configured to be accelerated. 
+
+## Data removal
+
+Once the data is not longer needed, you can simply delete the data from the thawed directory.