Help with configuring retention to 5 days, Splunk for BlueCoat

[mcbradford]

This app will eventually consume all available space on the search head it is installed on. Documentation does not address this. Response from developer goes unanswered.

I attempted to create a file called

tsidx_retention.conf

with the following

[bluecoat_stats]

5 days

retentionTimePeriodInSecs = 432000

I placed it at:

/opt/splunk/etc/apps/SplunkforBlueCoat/local/tsidx_retention.conf

But this is not working.

[hartfoml]

I could use help with this too. I was hoping that someone would have answered this by now.

Thanks for asking the question

[Mahieu]

Hi,

Same issue here.
I'm doing it with an external script which runs every week and looks for "old" tsidx files to remove them.
Could anyone from Splunk answer this please ?

Thanks in advance