topic Re: Change frozenTimePeriodInSecs of an existing indexes in Deployment Architecture

Change frozenTimePeriodInSecs of an existing indexes

GaetanVP — Mon, 03 Jul 2023 15:03:55 GMT

Hello Splunkers,

I would like to change the value of frozenTimePeriodInSecs for one of my existing indexes.

What should I be careful of ? Juste change the value on my Master Node and push the new bundle to my Indexers ?

Also since my frozenTimePeriodInSecs will be lower than some of my bucket indexes, those events will be automatically rolled to frozen ?

Thanks a lot !
GaetanVP

Re: Change frozenTimePeriodInSecs of an existing indexes

richgalloway — Mon, 03 Jul 2023 15:08:51 GMT

As always when changing frozenTimePeriodInSecs, make sure you have the correct value. Leaving out a digit or doing the maths wrong may result in unintended data deletion.

That said, you have the right idea. Change the setting on the Cluster Manager and push the bundle. The indexers will then freeze any buckets that have no data newer than the new frozenTimePeriodInSecs value.

Re: Change frozenTimePeriodInSecs of an existing indexes

isoutamo — Mon, 03 Jul 2023 15:37:35 GMT

one old post to answering your next question “Why I still have older data than….” 😉 It contains also one old but still mostly valid conf presentation.

https://community.splunk.com/t5/Deployment-Architecture/When-will-my-buckets-roll/m-p/579468

r. Ismo