topic Re: Increase Cold retention period in Knowledge Management

Increase Cold retention period

saeed — Sun, 31 Jan 2021 07:41:49 GMT

Hi,

I would like to increase the cold retention period for index [pa] to 180 days, but when i get into indexes.conf i only see below configuration there is no frozenTimePeriodInSecs = for index pa

# Index for Palo Alto Networks
# This index is required by Splunk_TA_paloalto
[pa]
repFactor = auto
homePath = volume:hot/pa/db
homePath.maxDataSizeMB = 512000
coldPath = volume:cold/pa/colddb
coldPath.maxDataSizeMB = 512000
thawedPath = $SPLUNK_DB_THAWED/pa/thaweddb
coldToFrozenDir = $SPLUNK_DB_FROZEN/pa/frozendb

where can i find the time setting for this index?

Re: Increase Cold retention period

gcusello — Sun, 31 Jan 2021 08:46:36 GMT

Hi @saeed,

probably your index takes the retention period from the default value (6 years) or from another default definition.

Anyway,

you can add to your index definition also the option:

frozenTimePeriodInSecs = 180

in this way you define the retention period for that index.

Ciao.

Giuseppe

Re: Increase Cold retention period

saeed — Sun, 31 Jan 2021 09:32:43 GMT

Thanks a lot

I will add it and it will be like this:

[pa]
repFactor = auto
homePath = volume:hot/pa/db
homePath.maxDataSizeMB = 512000
coldPath = volume:cold/pa/colddb
coldPath.maxDataSizeMB = 512000
thawedPath = $SPLUNK_DB_THAWED/pa/thaweddb
coldToFrozenDir = $SPLUNK_DB_FROZEN/pa/frozendb
frozenTimePeriodInSecs = 15552000

Correct?

Re: Increase Cold retention period

gcusello — Mon, 01 Feb 2021 07:27:32 GMT

Hi @saeed,

if this answer solves your problem, please accept it for the other people of Community.

Otherwise, please tell me what's you problem so I can help you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Increase Cold retention period

saeed — Mon, 01 Feb 2021 08:22:21 GMT

Thanks a lot @gcusello

My problem is the current retention period is 52 days and i want to increase the cold storage for Palo Alto index to be searchable for the last 6 months , i only found time setting under [ default ]:

frozenTimePeriodInSecs = 4492800

i didn't find time period for index [pa]

Re: Increase Cold retention period

gcusello — Mon, 01 Feb 2021 08:34:16 GMT

Hi @saeed,

in this case, inserting frozenTimePeriodInSecs in the "pa" index definition (in indexes.conf) you override the default value and you give the value you want only to this index.

Ciao and happy splunking.

Giuseppe