https://community.splunk.com/t5/Getting-Data-In/frozenTimePeriodInSecs-and-coldToFrozenScript/m-p/221058#M98881 <P>To implement the data retention policy, you would need to set minimum of frozenTimePeridInSecs needs to be set. By default the frozen buckets will be deleted. If you want to archive the frozen bucket then any one of coldToFrozenScript OR coldToFrozenDir needs to be specified. If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir will take precedence.</P> <P>See more information here. <A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/Admin/indexesconf">http://docs.splunk.com/Documentation/Splunk/6.2.5/Admin/indexesconf</A></P> <P>There are other parameters that may needs to be set (based on your environment), see more details here<BR /> <A href="http://wiki.splunk.com/Deploy:BucketRotationAndRetention">http://wiki.splunk.com/Deploy:BucketRotationAndRetention</A></P> Mon, 14 Sep 2015 14:57:43 GMT somesoni2 2015-09-14T14:57:43Z https://community.splunk.com/t5/Getting-Data-In/frozenTimePeriodInSecs-and-coldToFrozenScript/m-p/221057#M98880 <P>frozenTimePeriodInSecs….if you set this to seconds and set a frozen path….is this enough to freeze data? Do I always need to specify a cold to frozen script? What if I just want Splunk to do this automatically?</P> Mon, 14 Sep 2015 12:54:06 GMT https://community.splunk.com/t5/Getting-Data-In/frozenTimePeriodInSecs-and-coldToFrozenScript/m-p/221057#M98880 DazzedNConfused 2015-09-14T12:54:06Z https://community.splunk.com/t5/Getting-Data-In/frozenTimePeriodInSecs-and-coldToFrozenScript/m-p/221058#M98881 <P>To implement the data retention policy, you would need to set minimum of frozenTimePeridInSecs needs to be set. By default the frozen buckets will be deleted. If you want to archive the frozen bucket then any one of coldToFrozenScript OR coldToFrozenDir needs to be specified. If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir will take precedence.</P> <P>See more information here. <A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/Admin/indexesconf">http://docs.splunk.com/Documentation/Splunk/6.2.5/Admin/indexesconf</A></P> <P>There are other parameters that may needs to be set (based on your environment), see more details here<BR /> <A href="http://wiki.splunk.com/Deploy:BucketRotationAndRetention">http://wiki.splunk.com/Deploy:BucketRotationAndRetention</A></P> Mon, 14 Sep 2015 14:57:43 GMT https://community.splunk.com/t5/Getting-Data-In/frozenTimePeriodInSecs-and-coldToFrozenScript/m-p/221058#M98881 somesoni2 2015-09-14T14:57:43Z