topic Re: Does frozenTimePeriodInSecs work in [default]? in Splunk Search

Does frozenTimePeriodInSecs work in [default]?

wsanderstii — Thu, 25 Jan 2018 20:53:41 GMT

I have a local indexes.conf file on all my indexers:
[default]
frozenTimePeriodInSecs = 63072000 # 2 yr
[main]
frozenTimePeriodInSecs = 15552000 # 180d

This seems to have worked on main but not on any other indexes. Does frozenTimePeriodInSecs work in [default]? Or do I have to enter a value for each index? Or should I put the value outside a stanza?

Re: Does frozenTimePeriodInSecs work in [default]?

somesoni2 — Thu, 25 Jan 2018 21:00:29 GMT

The attribute frozenTimePeriodInSecs is per index option, so it should be specified in the stanza for each index. Without specifying it, default value of it would be 6 years or 188697600.

When you specify it in [default] section, it's getting applied to default index which is main (as specified in attribute defaultDatabase)

Re: Does frozenTimePeriodInSecs work in [default]?

mayurr98 — Fri, 26 Jan 2018 05:56:36 GMT

The information you see under [default] is a global setting that take precedence if you haven't defined a setting for a specific index. These settings come from /etc/system/default/indexes.conf. This can be a bit confusing as if you look into indexes.conf, global settings do not exist within a [default] stanza. Additionally, there is no need to create a [default] stanza.

If you take a look at the settings in $SPLUNK_HOME/etc/system/default/indexes.conf, you'll notice the settings for frozenTimePeriodInSecs matches the setting under this section:

<code># index specific defaults
frozenTimePeriodInSecs = 188697600
</code>

Since this setting also exists for [main], per the btool ouput, the setting for main takes precedence. This is part of the reason that btool is a technical support utility. The output can be confusing if you aren't sure what to expect. In this instance, since btool does show main as having the value defined, you can be sure that this is what will take effect. If you wanted to ensure all indexes had this behavior by default, you could copy the global settings from $SPLUNK_HOME/etc/system/default/indexes.conf into $SPLUNK_HOME/etc/system/local/indexes.conf.

Also,
You set it in local/indexes.conf on an index per index basis.
And yes you can do it exactly as you state.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy

[your_custom_index]
 frozenTimePeriodInSecs = <retention_period>

let me know if this helps!

Re: Does frozenTimePeriodInSecs work in [default]?

wsanderstii — Fri, 26 Jan 2018 17:29:14 GMT

Actually what worked was putting "frozenTimePeriodInSecs = 63072000" (2 years) outside of any stanza in /opt/splunk/etc/master-apps/_cluster/local/indexes.conf.

Thanks for the replies.