Deployment Architecture

Events for an index are not retained per desired retention policies

sagaraverma
Loves-to-Learn Lots

I have an index for which I desire to retain 45 days of events .


I have multiple values set under indexes.conf for the same :-
frozenTimePeriodInSecs = 3888000
maxDataSize=auto_high_volume
maxHotBuckets = 10
maxWarmDBCount = 15
maxTotalDataSizeMB = 512000

Although desired retention is 45 days but index is only able to retain 21 days of data.

Please be noted that I do understand meaning of all such parameters and how they may effect overall retention.

But I am looking for some method / search query which can show/evaluate - what/which parameter amongst all above is taking precedence (based on ingested volume, bucket count reach, etc) for an index and rolling buckets to age and hence letting only 21 days of data to retain. 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If I bucket is deleted sooner than expected then it's probably because of size constraints.  The index reached one of  maxTotalDataSizeMB or maxVolumeDataSizeMB.  The reason for freezing a bucket should be logged.  Search index=_internal sourcetype=splunkd component=BucketMover.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

scelikok
Champion

Hi @sagaraverma,

Buckets get frozen by frozenTimePeriodInSecs or maxTotalDataSizeMB, whichever hits first. Your case seems to be hitting maxTotalDataSizeMB. You can check the freeze reason using below query, it will show you the reason in event_message field.

index=_internal component=BucketMover will attempt to freeze

 

If this reply helps you an upvote is appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!