topic Re: how change sinkhole directory and configure it? in Getting Data In

how change sinkhole directory and configure it?

giovere — Fri, 02 Sep 2011 13:36:02 GMT

I'm trying to change sinkhole directory and configure it so that it will delete files only after 5 days or so. Is there a way to achieve this?

Re: how change sinkhole directory and configure it?

MuS — Mon, 05 Sep 2011 06:25:47 GMT

Hi giovere

you can setup a sinkhole with the batch stanza, meaning you can define any directory as sinkhole. the move_policy sinkhole tells splunk to load the file destructively. there is no way to tell splunk to delete files after five days or so.......

but you could setup a montior stanza instead of a batch stanza and use logadm (on *nix) to rotate/delete the files away after 5 days.

further information about monitor/batch stanzas can go to -> click me

kind regards

Re: how change sinkhole directory and configure it?

giovere — Mon, 05 Sep 2011 15:56:58 GMT

thanks a lot! I'll give it a try tomorrow, do you know if I can remove 5 or so days old data+indexes from the Splunk itself and what's the way to do it?

Re: how change sinkhole directory and configure it?

MuS — Tue, 06 Sep 2011 05:25:55 GMT

you can set various time related settings in indexes.conf http://docs.splunk.com/Documentation/Splunk/4.2.3/admin/Indexesconf I think with some try & error you should be able to achieve this.

Re: how change sinkhole directory and configure it?

Steve_G_ — Tue, 06 Sep 2011 17:59:39 GMT

You can set a retirement policy to remove indexed data when it reaches a configurable age. For details, see:

http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Setaretirementandarchivingpolicy

Re: how change sinkhole directory and configure it?

giovere — Wed, 07 Sep 2011 09:54:11 GMT

Awesome! thanks ...