topic Re: increase logs indexing time in Monitoring Splunk

increase logs indexing time

aalaa — Tue, 09 Jul 2019 10:02:40 GMT

i want to increase the log indexing time, for the moment the log are only accessible two days on my indexer and search head, how can i increase the time for the logs to go accessible for two months ? Any help please !
thank you

Re: increase logs indexing time

tiagofbmm — Tue, 09 Jul 2019 10:15:46 GMT

I think you're trying to say you want the logs to stay available for 2 months (retention period). The field _indextime is not changeable.

You can change in indexes.conf the maxTotalDataSizeMB and frozenTimePeriodInSecs attributes. They help determine when buckets roll from cold to frozen.

If you didn't change the default configuration, frozen means the logs are removed from Splunk. So basically if you want your logs to reside for longer, increase the frozenTimePeriodInSecs:

[<indexname>]
frozenTimePeriodInSecs =

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Setaretirementandarchivingpolicy

Re: increase logs indexing time

aalaa — Tue, 09 Jul 2019 10:21:42 GMT

Thank you !
index.conf under the Search head or the indexer ?
what is the value to add in frozenTimePeriodInSecs for two months ?

Re: increase logs indexing time

tiagofbmm — Tue, 09 Jul 2019 10:24:07 GMT

In the indexer indexes.conf of the Indexer only

If you want 2 months then convert it to seconds: 60*86400=5184000

[]
frozenTimePeriodInSecs =

Re: increase logs indexing time

aalaa — Tue, 09 Jul 2019 10:26:54 GMT

thank you 🙂

Re: increase logs indexing time

tiagofbmm — Tue, 09 Jul 2019 10:28:33 GMT

welcome. don't forget to upvote the accepted answer 😉