Deployment Architecture

How do I roll buckets to frozen by # of days?

jamesvz84
Communicator

I would like to keep data for an index around for no longer than 6 months. Is there a setting to do this or can I only roll based on size?

Tags (2)
0 Karma
1 Solution

ppablo
Retired

Hi @jamesvz84

I think you're looking for the frozenTimePeriodInSecs configuration. Here's the relevant documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy#Set_attri...

View solution in original post

masonmorales
Influencer

It's possible, but not from the GUI. You need to edit your indexes.conf (likely at either $SPLUNK_HOME/etc/system/local/indexes.conf -- or $SPLUNK_HOME/etc/apps/search/local/indexes.conf) and add the following to whichever index stanza you want to change:

frozenTimePeriodInSecs = 15778463

Then, restart the indexer for the change to take effect.

See also: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy#Set_att...

masonmorales
Influencer
0 Karma

ppablo
Retired

Hi @jamesvz84

I think you're looking for the frozenTimePeriodInSecs configuration. Here's the relevant documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy#Set_attri...

ppablo
Retired

Just adding extra info, the default configuration is frozenTimePeriodInSecs=188697600 which is 6 years before data gets rolled to frozen, but the link provided actually uses 180 days (or 15552000 seconds) in the example which is approximately 6 months.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...