topic Re: How do I permanently delete logs from an index in Getting Data In

How do I permanently delete logs from an index

mike7860 — Wed, 13 Mar 2013 16:56:28 GMT

Hi all:

I would like to know how do we delete logs from an indexer after 90 days in splunk. Some answers durected me to this output : [main]
frozenTimePeriodInSecs = 7776000

This wil delete data from the main index after 90 days (so its in seconds).

But this will only freeze the data not completely remove it from the index. Your help will be appreciated.

Thanks

Re: How do I permanently delete logs from an index

alacercogitatus — Wed, 13 Mar 2013 17:07:35 GMT

Actually, unless you specify a script to freeze it, the data gets deleted. So that should automatically delete the data for you.

From the doc: * If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Indexesconf