How to keep Firepower Estreamer logs for 1 year?

[hrt2000]

Hi
I have Firepower . and sends my logs with estreamer to Splunk.
my problem :
Splunk keeps logs for 70 days, and before 70 days I don't have any logs on Splunk.

How do I keep my logs for 1 year on Splunk?

I read some notes about maxTotalDataSizeMB and frozenTimePeriodInSecs , that I must change the value in indexs.conf, but I dont know where I change them (GUI or CLI)?

I have many indexes.conf file whenever I search for it.
I changed maxTotalDataSizeMB value of 500gig to 800gig in index.conf in path opt/splunk/etc/system/local
but I don't find any parameter of frozenTimePeriodInSecs in that.

Whenever I use df -h command in cli, it shows, used 498gig of 840gig disk .and this parameter change between 488 and 498 gig .

Can anyone help me?

[richgalloway]

By default, indexes retain data for 7 years so if your index is only keeping data for 70 days then there must be a setting for it already.  Use btool to find it.

splunk btool --debug indexes list estreamer | grep frozenTimePeriodInSecs

Replace "estreamer" with the name of your index.  The output will contain the name of the indexes.conf file for the estreamer index.  Edit that file and set the desired retention period.  Then restart Splunk.

In a distributed environment, the indexes.conf changes must be made on all indexers.  If you have an indexer cluster then indexes.conf should be in an app on the Cluster Manager and pushed to all indexers.