topic Re: index retirement policies: size versus age in Splunk Search

index retirement policies: size versus age

ualbanytech — Wed, 06 Apr 2011 03:47:14 GMT

Where index retirement policies are concerned, if you define both size and age I assume first policy type hit wins?

Re: index retirement policies: size versus age

jbsplunk — Wed, 06 Apr 2011 05:10:16 GMT

That is correct, if you hit the size first, it wins. If the data becomes aged beyond what you've specified, that would win.

Re: index retirement policies: size versus age

gkanapathy — Wed, 06 Apr 2011 05:38:27 GMT

With the qualification that "age" is not an absolute for each item, but that items older than the specified retirement age may be deleted, as long as all items in the same bucket are also older than the retirement age.

Re: index retirement policies: size versus age

jbsplunk — Wed, 06 Apr 2011 05:49:12 GMT

Thanks for the clarification.

Re: index retirement policies: size versus age

ualbanytech — Wed, 06 Apr 2011 06:25:45 GMT

@gkanapathy, for age, does that imply that deletion may not occur until events go to frozen?

I just found: http://www.splunk.com/base/Documentation/4.1.6/admin/HowSplunkstoresindexes

and skimming it quickly--probably a mistake--it sounds like I could have newer events being added to a bucket which do not exceed my age policy and this would prevent my events from getting deleted.

However it sounds like the situation you mention should only occur in the warm buckets?