topic Re: How to Change Splunk frozenTimePeriodInSecs for any of the indexes in Splunk Enterprise

How to Change Splunk frozenTimePeriodInSecs for any of the indexes

CHAUHAN812 — Thu, 19 Dec 2024 11:02:38 GMT

I want to increase one of my index frozen Time Period from 12 months to 13 months. I have increased the Max Size of Entire Index from the Splunk indexer > Settings. But I know this is not enough as my index frozen Time Period is set on 12 months period.

So where should I update this value ?

Should I need to update 'Indexes.conf' file for required indexes to the indexer server itself which is installed on Linux machine.

What things I need to take care while updating this frozen Time Period.

Re: How to Change Splunk frozenTimePeriodInSecs for any of the indexes

isoutamo — Thu, 19 Dec 2024 11:55:11 GMT

If you have individual indexers then it is correct place. After change do reload for it. If you have indexer cluster then you must do this change on CM. Edit correct indexes.conf file somewhere under master-apps or manager-apps. After that apply cluster-bundle, when it has distributed into search peers.

Re: How to Change Splunk frozenTimePeriodInSecs for any of the indexes

CHAUHAN812 — Thu, 19 Dec 2024 12:35:18 GMT

Yes , I have an individual indexer which is installed on Linux machine. And I need to increase the frozenTimePeriodInSecs only for 2 of the indexes.

So to increase the Frozen Time Period from 12 months to 13 months then I just need to update the frozenTimePeriodInSecs values to the indexes.conf file from the indexer server right ?

Re: How to Change Splunk frozenTimePeriodInSecs for any of the indexes

luizlimapg — Thu, 19 Dec 2024 15:09:21 GMT

Hi @CHAUHAN812,

In that case, in the indexes.conf file, you just need to adjust the frozenTimePeriodInSecs parameter in the 2 index stanzas.

[index01] frozenTimePeriodInSecs = 34187400 [index02] frozenTimePeriodInSecs = 34187400

Restart Splunk after that

Re: How to Change Splunk frozenTimePeriodInSecs for any of the indexes

CHAUHAN812 — Thu, 19 Dec 2024 13:33:55 GMT

Thanks,

So this should be done in the indexer server right ?

Re: How to Change Splunk frozenTimePeriodInSecs for any of the indexes

luizlimapg — Thu, 19 Dec 2024 17:19:19 GMT

Right! If you have only one indexer

Re: How to Change Splunk frozenTimePeriodInSecs for any of the indexes

isoutamo — Thu, 19 Dec 2024 18:02:25 GMT

Here is link to docs https://docs.splunk.com/Documentation/Splunk/9.4.0/Indexer/Setupmultipleindexes
Remember if you are editing conf files then you must do restart or in some cases reload is enough. If you want to avoid that, then you should use GUI or CLI commands to modify those values.

Re: How to Change Splunk frozenTimePeriodInSecs for any of the indexes

CHAUHAN812 — Fri, 27 Dec 2024 15:40:07 GMT

Thank you for your quick responses. I have increased the frozen time period from my indexer machine. And I am able to increase it according to my requirement.

Re: How to Change Splunk frozenTimePeriodInSecs for any of the indexes

PickleRick — Fri, 27 Dec 2024 19:48:28 GMT

Or REST.