topic Re: Why is frozenTimePeriodInSecs 188697600 ? in Getting Data In

Why is frozenTimePeriodInSecs 188697600 ?

sunrise — Fri, 29 Nov 2013 11:59:41 GMT

Hi Splunkers,

Just my interest, not a serious question.
Why is frozenTimePeriodInSecs about 6 years (188697600 secs =2184 days =5.9835 years),
not just 6 years ?

Thanks.

Re: Why is frozenTimePeriodInSecs 188697600 ?

yannK — Fri, 29 Nov 2013 17:55:02 GMT

yes, its about 6 time 364, maybe an approximation for the leap-years.
You can redefine a new default in /local/indexes.conf if you need.

Re: Why is frozenTimePeriodInSecs 188697600 ?

mlhadmin — Thu, 05 Dec 2024 00:19:26 GMT

I don't see how leap years could have anything to do with it. A leap year has 1 more day than a regular year, so that doesn't explain why they would use 1 less day than a regular year...

Re: Why is frozenTimePeriodInSecs 188697600 ?

PickleRick — Thu, 05 Dec 2024 10:08:23 GMT

A golden shovel award goes to you, sir/madam. 🙂

This is a thread from 11 years ago.

And the answer to the original question is probably "someone made a typo and mistakenly multiplied by 364 instead of 365".

Re: Why is frozenTimePeriodInSecs 188697600 ?

mlhadmin — Thu, 05 Dec 2024 23:09:32 GMT

It looks like this mystery has not been solved within those 11 years though!

If your guess is correct, I guess they hadn't implemented Pull Requests yet whenever that code was added... 😜

I went looking for this answer, though, because in Splunk Cloud the _audit index is set to this default value for retention, and you are unable to change the retention setting for internal indexes in Splunk Cloud, so if you have a requirement to retain audit logs for 6 years, you're technically short by 6 days!

Re: Why is frozenTimePeriodInSecs 188697600 ?

PickleRick — Fri, 06 Dec 2024 08:47:22 GMT

You can raise a case with Cloud support.