https://community.splunk.com/t5/Monitoring-Splunk/Audit-index-clean-up/m-p/533294#M4704 <P>Hello, I am trying to delete data from _audit index. Currently it contains last 6 years data and occupying lot of space. I modified the $SPLUNK_HOME/etc/system/default/indexes.conf and added below under _audit stanza:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">[_audit] FrozenTimePeriodInSecs = 3153600</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>I restarted the splunk after making the changes. But I still see older data under Audit. Can you please help in finding what is wrong here? Do I need to make any additional changes or invoke anything to reflect the changes?</P><P>Thanks in advance for your help.</P> Wed, 16 Dec 2020 09:16:43 GMT rranjan2020 2020-12-16T09:16:43Z https://community.splunk.com/t5/Monitoring-Splunk/Audit-index-clean-up/m-p/533294#M4704 <P>Hello, I am trying to delete data from _audit index. Currently it contains last 6 years data and occupying lot of space. I modified the $SPLUNK_HOME/etc/system/default/indexes.conf and added below under _audit stanza:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">[_audit] FrozenTimePeriodInSecs = 3153600</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>I restarted the splunk after making the changes. But I still see older data under Audit. Can you please help in finding what is wrong here? Do I need to make any additional changes or invoke anything to reflect the changes?</P><P>Thanks in advance for your help.</P> Wed, 16 Dec 2020 09:16:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/Audit-index-clean-up/m-p/533294#M4704 rranjan2020 2020-12-16T09:16:43Z https://community.splunk.com/t5/Monitoring-Splunk/Audit-index-clean-up/m-p/533324#M4705 <P>It might be configured in some other apps. Please check the value through btool.</P><P>./splunk btool indexes list _audit --debug | grep&nbsp;frozenTimePeriodInSecs</P> Wed, 16 Dec 2020 12:51:26 GMT https://community.splunk.com/t5/Monitoring-Splunk/Audit-index-clean-up/m-p/533324#M4705 saravanan90 2020-12-16T12:51:26Z