https://community.splunk.com/t5/Getting-Data-In/Configure-Spunk-Hot-Warm-Cold-and-Frozen/m-p/481336#M82506 <P>How do I configure HOT / WARM, COULD, and FROZEN in Splunk Enterpise?</P> <P>I need to configure Splunk Data Retention and which folder and file to make sure of this setting.</P> <P>The settings I need to provide for Splunk. My Splunk version is 7.2</P> <P>Hot / Warm = 14 days<BR /> Could = 60 days<BR /> Frozen = 11 months</P> <P>Can you help me with this setting?</P> Thu, 09 Jan 2020 17:41:14 GMT erlindemberg 2020-01-09T17:41:14Z https://community.splunk.com/t5/Getting-Data-In/Configure-Spunk-Hot-Warm-Cold-and-Frozen/m-p/481336#M82506 <P>How do I configure HOT / WARM, COULD, and FROZEN in Splunk Enterpise?</P> <P>I need to configure Splunk Data Retention and which folder and file to make sure of this setting.</P> <P>The settings I need to provide for Splunk. My Splunk version is 7.2</P> <P>Hot / Warm = 14 days<BR /> Could = 60 days<BR /> Frozen = 11 months</P> <P>Can you help me with this setting?</P> Thu, 09 Jan 2020 17:41:14 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-Spunk-Hot-Warm-Cold-and-Frozen/m-p/481336#M82506 erlindemberg 2020-01-09T17:41:14Z https://community.splunk.com/t5/Getting-Data-In/Configure-Spunk-Hot-Warm-Cold-and-Frozen/m-p/481337#M82507 <P>You cannot set time retention on hot or warm buckets, it rolls once a certain limit is reached.</P> <P>This links will help you set that up and understand the Splunk Data life cycle<BR /> <A href="https://wiki.splunk.com/Deploy:BucketRotationAndRetention">https://wiki.splunk.com/Deploy:BucketRotationAndRetention</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Configureindexstorage">https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Configureindexstorage</A><BR /> <A href="https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf">https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-data.pdf</A></P> Thu, 09 Jan 2020 19:25:44 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-Spunk-Hot-Warm-Cold-and-Frozen/m-p/481337#M82507 jarizeloyola 2020-01-09T19:25:44Z https://community.splunk.com/t5/Getting-Data-In/Configure-Spunk-Hot-Warm-Cold-and-Frozen/m-p/481338#M82508 <P>Buckets roll when they reach a certain size or when the reach a certain age, whichever happens first. To make time the only factor, you must set the size limit high enough that it is no longer a factor. It helps if your hot buckets are configured so they contain only a single day of data.</P> <P>Frozen buckets are not managed by Splunk. You control when they are deleted (using cron, etc.).</P> Fri, 10 Jan 2020 11:56:11 GMT https://community.splunk.com/t5/Getting-Data-In/Configure-Spunk-Hot-Warm-Cold-and-Frozen/m-p/481338#M82508 richgalloway 2020-01-10T11:56:11Z