https://community.splunk.com/t5/Getting-Data-In/How-to-reduce-historical-data-length/m-p/50307#M96771 <P>Awesome, thanks. We index millions of events/day (and would need many, many terabytes to index over a year) so I have reduced mine from 90 days to 60 days.</P> Wed, 28 Aug 2013 20:53:20 GMT echojacques 2013-08-28T20:53:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-reduce-historical-data-length/m-p/50305#M96769 <P>My main Splunk index is near it's max size (~500GB). Instead of filtering out more data (nullQueue) I'd like to look into the possibility of reducing the amount of historical data it stores (store 2 months of events instead of 3 months). I've heard that some people configure Splunk to keep 6 months and others keep just 1 month. Where can I check and possibly modify this?</P> <P>Thanks.</P> Wed, 28 Aug 2013 20:25:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reduce-historical-data-length/m-p/50305#M96769 echojacques 2013-08-28T20:25:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-reduce-historical-data-length/m-p/50306#M96770 <P>Yes it' s possible to setup any bucket retention time, based on the timestamp of the events in the bucket.</P> <P>check the setting frozenTimePeriodInSecs in indexes.conf (default is ~ 6 years)<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/Configureindexstorage">http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/Configureindexstorage</A></P> Wed, 28 Aug 2013 20:50:43 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reduce-historical-data-length/m-p/50306#M96770 yannK 2013-08-28T20:50:43Z https://community.splunk.com/t5/Getting-Data-In/How-to-reduce-historical-data-length/m-p/50307#M96771 <P>Awesome, thanks. We index millions of events/day (and would need many, many terabytes to index over a year) so I have reduced mine from 90 days to 60 days.</P> Wed, 28 Aug 2013 20:53:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reduce-historical-data-length/m-p/50307#M96771 echojacques 2013-08-28T20:53:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-reduce-historical-data-length/m-p/50308#M96772 <P>well. you can just leave it as it is, and it will automatically delete the oldest buckets as needed to stay within the 500GB limit.</P> Wed, 28 Aug 2013 21:07:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-reduce-historical-data-length/m-p/50308#M96772 kristian_kolb 2013-08-28T21:07:11Z