https://community.splunk.com/t5/Getting-Data-In/2-year-retention-policy/m-p/81722#M97134 <P>No, that's not really correct.</P> <P>You should have a look at the following reference:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy">http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy</A></P> <P>But at a highlevel you will need to use the <CODE>frozenTimePeriodInSecs</CODE> parameter for each Index stanza OR globally in your <CODE>indexes.conf</CODE> file.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Indexesconf">http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Indexesconf</A></P> <P>Hope this helps.</P> <P>P.S. Plan this change correctly... you may lose your data incorrectly... would be a good idea to do a backup of data first!</P> Tue, 02 Jul 2013 12:47:49 GMT MHibbin 2013-07-02T12:47:49Z https://community.splunk.com/t5/Getting-Data-In/2-year-retention-policy/m-p/81721#M97133 <P>Hi guy, how do I go about setting a limit on our data retention.</P> <P>I need the data on the indexer to be deleted after 2 years, is there a way to do tjis via the web interface or is this somthing that must be done in the inputs.conf on the indexer itself.</P> <P>Also am I correct in thinking that you have to define the time in seconds if going down the inputs.conf route ?</P> <P>Cheers</P> <P>Aaron</P> Tue, 02 Jul 2013 10:43:51 GMT https://community.splunk.com/t5/Getting-Data-In/2-year-retention-policy/m-p/81721#M97133 AaronMoorcroft 2013-07-02T10:43:51Z https://community.splunk.com/t5/Getting-Data-In/2-year-retention-policy/m-p/81722#M97134 <P>No, that's not really correct.</P> <P>You should have a look at the following reference:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy">http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy</A></P> <P>But at a highlevel you will need to use the <CODE>frozenTimePeriodInSecs</CODE> parameter for each Index stanza OR globally in your <CODE>indexes.conf</CODE> file.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Indexesconf">http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Indexesconf</A></P> <P>Hope this helps.</P> <P>P.S. Plan this change correctly... you may lose your data incorrectly... would be a good idea to do a backup of data first!</P> Tue, 02 Jul 2013 12:47:49 GMT https://community.splunk.com/t5/Getting-Data-In/2-year-retention-policy/m-p/81722#M97134 MHibbin 2013-07-02T12:47:49Z