Deployment Architecture

Can I manually trigger events in an index to roll to frozen?

andrewtrobec
Motivator

Hello,

I am relatively new to the topic of event rolling between buckets, and I'd like to know how much flexibility I have in choosing what to roll and when. More specifically I would like to trigger an event to roll to frozen (i.e delete) based on field criteria within the event itself. Is this possible?

For example, if I am tracking tasks and I want closed tasks that are older than 6 months to be deleted (not soft delete using delete command), would it be possible to orchestrate some logic that will check both _time and state fields and then roll to frozen?

Thank you and best regards,

Andrew

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Events do not roll between buckets. Entire buckets roll from hot/warm to cold to frozen. Therefore, it is not possible to select individual events to freeze.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Events do not roll between buckets. Entire buckets roll from hot/warm to cold to frozen. Therefore, it is not possible to select individual events to freeze.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...