https://community.splunk.com/t5/Getting-Data-In/How-to-implement-a-new-Retention-Policy-and-what-changes-take/m-p/286500#M54673 <P>Yes, the changes are in effect immediately and old data will be frozen (deleted) if necessary to meet the requirements of the new settings. Your indexers definitely should come with an <CODE>indexes.conf</CODE> file.<BR /> Hot buckets cannot be frozen so it will only be warm buckets (cold is frozen already).<BR /> Keep in mind that this has NOTHING to do with deleting the original files that you are forwarding with <CODE>monitor</CODE> configurations in <CODE>inputs.conf</CODE>.</P> Fri, 03 Jun 2016 08:27:00 GMT woodcock 2016-06-03T08:27:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-implement-a-new-Retention-Policy-and-what-changes-take/m-p/286499#M54672 <P>Hi, </P> <P>I'm currently researching on the use of Retention Policy on Splunk by setting it to only keep data for 6 months. I will most likely be editing <CODE>frozenTimePeriodInSecs</CODE> attribute in <CODE>indexes.conf</CODE>. The attribute is currently set to default (which is 6 years I think).</P> <P>I have a few questions regarding the implementation of the retention policy and I can't seem to find the answer online. </P> <P>May I know after I make the changes to indexes.conf and restart Splunk.<BR /> <STRONG>- Does the change take effect immediately? <BR /> - What happens to the old data (eg those older than 6 months), will the old data be deleted immediately after restarting? <BR /> - Do I have to create the indexes.conf file, or is it already stored inside the server?<BR /> - Does this change affect all the buckets, or only those older data in the warm/cold buckets?</STRONG></P> <P>I'm using Splunk to do some automated housekeeping for my log data and I wish to know more about it. </P> <P>Any help will be greatly appreciated. Thank you.</P> Fri, 03 Jun 2016 08:21:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-implement-a-new-Retention-Policy-and-what-changes-take/m-p/286499#M54672 qiaojing 2016-06-03T08:21:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-implement-a-new-Retention-Policy-and-what-changes-take/m-p/286500#M54673 <P>Yes, the changes are in effect immediately and old data will be frozen (deleted) if necessary to meet the requirements of the new settings. Your indexers definitely should come with an <CODE>indexes.conf</CODE> file.<BR /> Hot buckets cannot be frozen so it will only be warm buckets (cold is frozen already).<BR /> Keep in mind that this has NOTHING to do with deleting the original files that you are forwarding with <CODE>monitor</CODE> configurations in <CODE>inputs.conf</CODE>.</P> Fri, 03 Jun 2016 08:27:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-implement-a-new-Retention-Policy-and-what-changes-take/m-p/286500#M54673 woodcock 2016-06-03T08:27:00Z