https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-retention-in-indexes-conf/m-p/87523#M18157 <P>Hello,</P> <P>I have been trying to set an index retention policy on my indexer but it does not seem to be removing any of the older data. I setup a simple stanza for the _internal index to remove data after 30 days and then plan to implement a similar policy to different index types.</P> <P>Is there something else I need to do other than this in $SPLUNK_HOME/etc/system/local/indexes.conf:</P> <P>[_internal]<BR /> frozenTimePeriodInSecs = 2592000</P> Mon, 08 Apr 2013 16:55:49 GMT aaronkorn 2013-04-08T16:55:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-retention-in-indexes-conf/m-p/87523#M18157 <P>Hello,</P> <P>I have been trying to set an index retention policy on my indexer but it does not seem to be removing any of the older data. I setup a simple stanza for the _internal index to remove data after 30 days and then plan to implement a similar policy to different index types.</P> <P>Is there something else I need to do other than this in $SPLUNK_HOME/etc/system/local/indexes.conf:</P> <P>[_internal]<BR /> frozenTimePeriodInSecs = 2592000</P> Mon, 08 Apr 2013 16:55:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-retention-in-indexes-conf/m-p/87523#M18157 aaronkorn 2013-04-08T16:55:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-retention-in-indexes-conf/m-p/87524#M18158 <P>It would help if the path was correct where I specified the db!</P> Mon, 08 Apr 2013 17:56:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-set-data-retention-in-indexes-conf/m-p/87524#M18158 aaronkorn 2013-04-08T17:56:33Z