I want to setup a script to delete frozen data that older than 36 months.
If I run the script to delete data from one peer in clustered environment on scheduled basis, is another peer going to replicate that data, once this is deleted from peer 1?
If you are talking about frozen data stored using coldToFrozenScript
then I guess splunk doesn't have idea about those data and you can safely remove that data and if same data archived on other indexer then it will not replicate to another indexer.
Thank you !
Splunk doesn't know anything about your frozen data so you are free to do anything you like with those buckets.
ok, thanks