topic Re: Retention index or log 90 days in Getting Data In

Retention index or log 90 days

jirakritwang — Fri, 04 Jul 2014 08:52:21 GMT

Hi. I use Splunk 6.1 free version, Can i config splunk for keep index or log 90 days and delete index or log older than 90 days.

Thank you.
Jira

Re: Retention index or log 90 days

Ayn — Fri, 04 Jul 2014 10:23:27 GMT

Yes. Check out the frozenTimePeriodInSecs setting in indexes.conf. By setting this to 7776000 (90 days in seconds) Splunk will delete data in its index when it becomes older than this limit. You're asking about deleting "index or log" - not sure what you mean by that, but Splunk will not delete any of the actual log files that it's read data from, that's something you need to set up separately.

http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Indexesconf

Re: Retention index or log 90 days

dhavamanis — Tue, 05 Aug 2014 15:57:02 GMT

Thank you!, i want to delete the indexed data / log. Sorry for the confusion. seems this frozenTimePeriodInSecs needs to enable per index, not for global. can you please confirm?. Also can you please provide the steps to retain summary index as historical data.

Re: Retention index or log 90 days

somesoni2 — Tue, 05 Aug 2014 16:07:23 GMT

The data older than frozenTimePeriodInSecs will get deleted from Splunk. This setting is per index, not global. Setting a higher value of frozenTimePeriodInSecs for summary indexes will ensure that summary index data is retained for longer period.