I would like to trim back on the amount of disk space being used. We have decided that we would like to keep about 18 months worth of data. We do not have to retain our data for any legislated period of time. Last week I added frozenTimePeriodInSecs = 46656000 to /opt/splunk/etc/system/local/indexes.conf.
I had assumed from the documentation that rotatePeriodInSecs = 60 in /opt/splunk/etc/system/default/indexes.conf would cause the move to frozen (delete) would start almost immediately after a restart. However, despite a restart, I still have data prior to 18 months ago.
Splunk will not freeze a bucket until the newest event in the bucket is older than frozenTimePeriodInSecs. Your buckets containing 18+ month old data could have just one event newer than that and it would be enough to keep the whole bucket alive. You could use the dbinspect search command to produce a report on the status of your various buckets. http://www.splunk.com/base/Documentation/latest/SearchReference/Dbinspect
You'd be looking for buckets where the latestTime is more than 46656000 seconds ago - those are the ones that should have rolled off by now.