Deployment Architecture

How do I roll buckets to frozen by # of days?

jamesvz84
Communicator

I would like to keep data for an index around for no longer than 6 months. Is there a setting to do this or can I only roll based on size?

Tags (2)
0 Karma
1 Solution

ppablo
Community Manager
Community Manager

Hi @jamesvz84

I think you're looking for the frozenTimePeriodInSecs configuration. Here's the relevant documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy#Set_attri...

View solution in original post

masonmorales
Influencer

It's possible, but not from the GUI. You need to edit your indexes.conf (likely at either $SPLUNK_HOME/etc/system/local/indexes.conf -- or $SPLUNK_HOME/etc/apps/search/local/indexes.conf) and add the following to whichever index stanza you want to change:

frozenTimePeriodInSecs = 15778463

Then, restart the indexer for the change to take effect.

See also: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy#Set_att...

masonmorales
Influencer
0 Karma

ppablo
Community Manager
Community Manager

Hi @jamesvz84

I think you're looking for the frozenTimePeriodInSecs configuration. Here's the relevant documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy#Set_attri...

ppablo
Community Manager
Community Manager

Just adding extra info, the default configuration is frozenTimePeriodInSecs=188697600 which is 6 years before data gets rolled to frozen, but the link provided actually uses 180 days (or 15552000 seconds) in the example which is approximately 6 months.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...