topic Re: How do I configure a data retention policy and a working script for my indexes? in Getting Data In

How do I configure a data retention policy and a working script for my indexes?

sunnyparmar — Tue, 12 Jan 2016 12:41:38 GMT

Hi,

I want to create a data retention policy for my all indexes, but I don't know how to configure this:
- coldToFrozenDir = "<path to frozen archive>"
- coldToFrozenScript =["<path to program that runs script>"] "<path to script>"
But how do we add this in the indexes.conf file? Can somebody give me the idea of doing this?

Thanks in advance.

Re: How do I configure a data retention policy and a working script for my indexes?

renjith_nair — Tue, 12 Jan 2016 13:03:36 GMT

Reference :

http://wiki.splunk.com/Deploy:BucketRotationAndRetention

http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Setaretirementandarchivingpolicy

http://docs.splunk.com/Documentation/Splunk/6.1/Admin/indexesconf

Re: How do I configure a data retention policy and a working script for my indexes?

alemarzu — Tue, 29 Sep 2020 08:24:45 GMT

Sunnyparmar,

You have to set the frozenTimePeriodInSecs = property for each index. Data will be searchable for the time you specified. And If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen.

[main]

90 days retention

frozenTimePeriodInSecs = 7776000
coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/bin/myColdToFrozenScript.py"

Re: How do I configure a data retention policy and a working script for my indexes?

sunnyparmar — Tue, 12 Jan 2016 13:50:45 GMT

thanks.. will do the same...