https://community.splunk.com/t5/Getting-Data-In/create-index-that-keeps-data-by-date-not-size/m-p/86024#M17886 <P>I have many indexes in my environment, which all have a maximum size set. However, we would like to instead keep data in an index according to date. For example: we want to keep all data in an index that is less than 30 days old. </P> <P>Is this possible?</P> <P>Thanks, <BR /> Sean </P> Wed, 10 Oct 2012 14:42:54 GMT seanlon11 2012-10-10T14:42:54Z https://community.splunk.com/t5/Getting-Data-In/create-index-that-keeps-data-by-date-not-size/m-p/86024#M17886 <P>I have many indexes in my environment, which all have a maximum size set. However, we would like to instead keep data in an index according to date. For example: we want to keep all data in an index that is less than 30 days old. </P> <P>Is this possible?</P> <P>Thanks, <BR /> Sean </P> Wed, 10 Oct 2012 14:42:54 GMT https://community.splunk.com/t5/Getting-Data-In/create-index-that-keeps-data-by-date-not-size/m-p/86024#M17886 seanlon11 2012-10-10T14:42:54Z https://community.splunk.com/t5/Getting-Data-In/create-index-that-keeps-data-by-date-not-size/m-p/86025#M17887 <P>After using some different search times, I have found how to do this by using the frozenTimePeriodInSecs attribute for an index when setting it up in the indexes.conf file.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy#Freeze_data_when_it_grows_too_old:_Set_frozenTimePeriodInSecs">http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy#Freeze_data_when_it_grows_too_old:_Set_frozenTimePeriodInSecs</A></P> <P>Simple now that I found it, but maybe this helps someone else out there.</P> Thu, 11 Oct 2012 14:27:47 GMT https://community.splunk.com/t5/Getting-Data-In/create-index-that-keeps-data-by-date-not-size/m-p/86025#M17887 seanlon11 2012-10-11T14:27:47Z