Archive

index retirement policies: size versus age

Path Finder

Where index retirement policies are concerned, if you define both size and age I assume first policy type hit wins?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

That is correct, if you hit the size first, it wins. If the data becomes aged beyond what you've specified, that would win.

View solution in original post

Splunk Employee
Splunk Employee

That is correct, if you hit the size first, it wins. If the data becomes aged beyond what you've specified, that would win.

View solution in original post

Path Finder

@gkanapathy, for age, does that imply that deletion may not occur until events go to frozen?

I just found: http://www.splunk.com/base/Documentation/4.1.6/admin/HowSplunkstoresindexes

and skimming it quickly--probably a mistake--it sounds like I could have newer events being added to a bucket which do not exceed my age policy and this would prevent my events from getting deleted.

However it sounds like the situation you mention should only occur in the warm buckets?

0 Karma

Splunk Employee
Splunk Employee

Thanks for the clarification.

0 Karma

Splunk Employee
Splunk Employee

With the qualification that "age" is not an absolute for each item, but that items older than the specified retirement age may be deleted, as long as all items in the same bucket are also older than the retirement age.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!