- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Change an existing index frozenTimePeriodInSecs Thru REST
dcroteau

Splunk Employee
10-04-2016
09:08 AM
I know you can create a new index through REST:
curl -k -u admin:changeme https://127.0.0.1:8089/servicesNS/admin/search/data/indexes -d name=mynewindex -d frozenTimePeriodInSecs=#######
Is there a way to change or update an existing indexes frozenTimePeriodInSecs though REST?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

supabuck
Path Finder
02-01-2017
12:32 PM
Hi dcroteau,
Let me know if the suggestion below worked.
Thanks!
-supabuck
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

supabuck
Path Finder
01-04-2017
01:19 PM
Hello dcroteau,
This absolutely can be done.
Based upon your example here is what you would do for the case of your index named mynewindex wanted to be changed to a year of retention:
curl -k -u admin:changeme https://127.0.0.1:8089/servicesNS/admin/search/data/indexes/mynewindex -d frozenTimePeriodInSecs=31536000
Specifying it in the path will alter the settings on that index via the REST endpoint.
Regards,
supabuck
