topic Re: Index log need to maintain only one year in Getting Data In

Index log need to maintain only one year

balamuruganm7 — Mon, 09 Sep 2019 09:42:52 GMT

Hi Team,

I am seeking help on indexer log retention period set.

I am using splunk enterprise version 6.4.2, deployed some 4 years ago so . indexer log contain more than one year and log to be restricted only one year.

Kindly help on setting indexer log to maintain one year only

Re: Index log need to maintain only one year

somesoni2 — Mon, 09 Sep 2019 13:32:42 GMT

Use this to find the current retention applied on the indexes you have:
https://answers.splunk.com/answers/553180/how-to-find-the-retention-period-of-an-index.html

Then follow this to understand and implement appropriate retention period.

Re: Index log need to maintain only one year

masonmorales — Mon, 09 Sep 2019 22:21:39 GMT

Assuming that you have removed frozenTimePeriodInSecs at the index-level config of all indexes in your indexes.conf file(s) (use splunk cmd btool indexes list --debug to check), you can do:
indexes.conf

[default]
frozenTimePeriodInSecs = 31536000

Re: Index log need to maintain only one year

balamuruganm7 — Tue, 10 Sep 2019 06:38:50 GMT

Hi Masonmorales,

I could see indexes.conf file under $SPLUNK_HOME/etc/system/local/, but I don't see any parameter frozenTimePeriodInSecs

indexes.conf files contain following
.
[splunklogger]
bucketRebuildMemoryHint = 0
compressRawdata = 1
enableDataIntegrityControl = 1
enableOnlineBucketRepair =1
enableTsidxReduction = 0
syncMeta =1

[ _internal]
bucketRebuildMemoryHint = 0
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair =1
enableTsidxReduction = 0
syncMeta =1

[ _interospection]

bucketRebuildMemoryHint = 0
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair =1
enableTsidxReduction = 0
syncMeta =1

[ -audit]

bucketRebuildMemoryHint = 0
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair =1
enableTsidxReduction = 0
syncMeta =1

Re: Index log need to maintain only one year

masonmorales — Fri, 13 Sep 2019 04:59:59 GMT

OK so just add it to the default stanza.

Re: Index log need to maintain only one year

balamuruganm7 — Fri, 13 Sep 2019 06:41:03 GMT

where should I add the default stanza?,where I should add the default stanza?