topic Re: How to increase logs retention period? in Getting Data In

How to increase logs retention period?

islam — Thu, 16 Jul 2020 16:12:04 GMT

Hi,

we are asked to increase our retention period of splunk logs to 1 year.

we need to put our data to be searchable for 1 year.

i'm very confused about hot, warm and cold data, are all of them is searchable or cold data is not searchable?

how can we configure this retenion period?

Re: How to increase logs retention period?

isoutamo — Thu, 16 Jul 2020 16:36:55 GMT

I hope that this will clarify it. https://sideviewapps.com/apps/cisco-cdr-reporting-and-analytics/documentation/administrative-concepts/data-retention-policies/?cn-reloaded=1
r. Ismo

Re: How to increase logs retention period?

islam — Sat, 18 Jul 2020 21:07:35 GMT

Thank you so much, it's a very useful article.

also i have one question: the values of frozenTimePeriodInSecs and maxTotalDataSizeMB should be put under every index or just one time at the beginning of indexes.cong file ?

Re: How to increase logs retention period?

isoutamo — Sun, 19 Jul 2020 10:40:20 GMT

If those are same for all your indexes then you can put those on default stanza and if not then you should add those to the individual indexes.

Re: How to increase logs retention period?

islam — Mon, 20 Jul 2020 08:56:17 GMT

can i put specific period for hot and cold data, like hot data to be 6 months and cold data to be 6 moths also ?

Re: How to increase logs retention period?

isoutamo — Mon, 20 Jul 2020 09:27:57 GMT

No, only cold period can defined as seconds. Hot/warm is defined by bucket count and/or size of homePath.
r. Ismo