topic Re: Index Retention by Time Only in Getting Data In

Index Retention by Time Only

aferone — Tue, 21 Feb 2012 17:19:08 GMT

We would like to retain data in our indexes by time only. Is this possible? I think I am doing it correctly for our internal index by using the following line, for 90 days:

frozenTimePeriodInSecs = 7776000

Is this correct, and can I use this line to retain indexes solely on time for all indexes, instead on disk size?

Thanks!

Re: Index Retention by Time Only

_d_ — Tue, 21 Feb 2012 19:44:19 GMT

Yes, this is correct. However, as a precaution I would also suggest setting maxTotalDataSizeMB to a reasonably large value so that frozenTimePeriodInSecs hits before it does.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

Re: Index Retention by Time Only

aferone — Tue, 21 Feb 2012 20:17:40 GMT

Thanks for answering! Can you explain the need for setting the maxtotaldatasizeMB though? Is it just as a fail safe?

Re: Index Retention by Time Only

_d_ — Tue, 21 Feb 2012 20:22:59 GMT

Yes. Splunk will freeze data when either of maxtotaldatasizeMB or frozenTimePeriodInSecs is reached first. So, if you reach a size of 500GB (which is the defult maxtotaldatasizeMB), say, on day 61, old data will be frozen even though it's not 90 days old.