https://community.splunk.com/t5/Getting-Data-In/Logs-Retention/m-p/691161#M114969 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/266281">@BRFZ</a>&nbsp;</P><P>yes, see at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Indexesconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Indexesconf</A></P><P>anyway, frozenTimeperiodInSecs is the all retention time (Hot+Warm+Cold), maxHotSpanSecs is the Hot+Warm period.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 20 Jun 2024 08:18:13 GMT gcusello 2024-06-20T08:18:13Z https://community.splunk.com/t5/Getting-Data-In/Logs-Retention/m-p/691158#M114968 <P>Hello,<BR />Is it possible to define the retention duration of logs (<STRONG>hot</STRONG>, <STRONG>warm</STRONG> and <STRONG>cold</STRONG>)&nbsp; If yes, how can this be done ? Or do we only have the option to define the <STRONG>frozenTimePeriodInSecs</STRONG> ?</P> Thu, 20 Jun 2024 07:47:05 GMT https://community.splunk.com/t5/Getting-Data-In/Logs-Retention/m-p/691158#M114968 BRFZ 2024-06-20T07:47:05Z https://community.splunk.com/t5/Getting-Data-In/Logs-Retention/m-p/691161#M114969 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/266281">@BRFZ</a>&nbsp;</P><P>yes, see at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Indexesconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Indexesconf</A></P><P>anyway, frozenTimeperiodInSecs is the all retention time (Hot+Warm+Cold), maxHotSpanSecs is the Hot+Warm period.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 20 Jun 2024 08:18:13 GMT https://community.splunk.com/t5/Getting-Data-In/Logs-Retention/m-p/691161#M114969 gcusello 2024-06-20T08:18:13Z