https://community.splunk.com/t5/Getting-Data-In/Data-Base-Retention-Adjustment/m-p/22558#M3492 <P>You should read this for details on how Splunk stores data:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/admin/HowSplunkstoresindexes">http://docs.splunk.com/Documentation/Splunk/4.3.1/admin/HowSplunkstoresindexes</A></P> <P>Info on maxhotIdlesecs:</P> <P><A href="http://splunk-base.splunk.com/answers/63323/how-does-the-attribute-maxhotidlesecs-work">http://splunk-base.splunk.com/answers/63323/how-does-the-attribute-maxhotidlesecs-work</A></P> Sun, 04 Nov 2012 15:54:45 GMT sdaniels 2012-11-04T15:54:45Z https://community.splunk.com/t5/Getting-Data-In/Data-Base-Retention-Adjustment/m-p/22557#M3491 <P>Hi All</P> <P>I want to set my Splunk server to keep logs active for 30 days then compress those logs, save it in another directory active for 90 days.</P> <P>what i know after some searches that all that configuration can be done from indexex.conf file but i didn't understand what is hot, cold &amp; frozen, what is maxhotIdlesecs??</P> <P>little help will be appreciated. </P> Sun, 04 Nov 2012 15:48:04 GMT https://community.splunk.com/t5/Getting-Data-In/Data-Base-Retention-Adjustment/m-p/22557#M3491 opel121 2012-11-04T15:48:04Z https://community.splunk.com/t5/Getting-Data-In/Data-Base-Retention-Adjustment/m-p/22558#M3492 <P>You should read this for details on how Splunk stores data:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/admin/HowSplunkstoresindexes">http://docs.splunk.com/Documentation/Splunk/4.3.1/admin/HowSplunkstoresindexes</A></P> <P>Info on maxhotIdlesecs:</P> <P><A href="http://splunk-base.splunk.com/answers/63323/how-does-the-attribute-maxhotidlesecs-work">http://splunk-base.splunk.com/answers/63323/how-does-the-attribute-maxhotidlesecs-work</A></P> Sun, 04 Nov 2012 15:54:45 GMT https://community.splunk.com/t5/Getting-Data-In/Data-Base-Retention-Adjustment/m-p/22558#M3492 sdaniels 2012-11-04T15:54:45Z