topic Why frozenTimePeriodInSecs does not take effect? in Monitoring Splunk

Why frozenTimePeriodInSecs does not take effect?

Gabriel — Thu, 10 Aug 2023 21:54:27 GMT

Hi everyone

I got a question on the frozenTimePeriodInSecs parameter. Here are my settings inside the indexes.conf file:

/opt/splunk/etc/system/local/indexes.conf

[_internal]
frozenTimePeriodInSecs = 864000 # Data retention set to 10 days.
maxTotalDataSizeMB = 750

[_audit]
frozenTimePeriodInSecs = 864000 # Data retention set to 10 days.
maxTotalDataSizeMB = 750

What I would expect is, that buckets in _internal and _audit where all events are older than 10 days get deleted. However, this is not the case. Anyone knows why? On the other hand, maxTotalDataSizeMB does work as expected.

I have checked a couple places for hints why frozenTimePeriodInSecs does not work. The results of those checks are further down below as screenshots.

- buckets: Whether there are buckets that contain only events older than 10 days.
- btools: Whether the settings are actually taken into account.
- monitoring console: Whether the settings are actually taken into account.
- _internal logs: Check whether there are freeze events occuring. They only appear for maxTotalDataSizeMB.

_audit Buckets_audit btool outputmonitoring console 1monitoring console 2freeze events

Re: frozenTimePeriodInSecs does not take effect

PickleRick — Thu, 10 Aug 2023 10:42:49 GMT

Normally it _should_ work.

The question is how you configured those retention parameters - webui/files/rest? If you did it with conf files, did you reload the daemon? While btool shows the contents of files on disk, you might want to check the runtime config from splunkd memory

splunk show config indexes

and check if it's the same as what btool reports.

Re: frozenTimePeriodInSecs does not take effect

Gabriel — Thu, 10 Aug 2023 10:51:31 GMT

Hi Rick 😃

I edited the indexes.conf file by hand on the server, then restarted splunk. Running the command you suggested also shows that frozenTimePeriodInSecs is equivalent to what btool reports and is active in the runtime:

runtime config