Deployment Architecture

How do I roll buckets to frozen by # of days?

Communicator

I would like to keep data for an index around for no longer than 6 months. Is there a setting to do this or can I only roll based on size?

Tags (2)
0 Karma
1 Solution

Community Manager
Community Manager

Hi @jamesvz84

I think you're looking for the frozenTimePeriodInSecs configuration. Here's the relevant documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy#Set_attri...

View solution in original post

Influencer

It's possible, but not from the GUI. You need to edit your indexes.conf (likely at either $SPLUNK_HOME/etc/system/local/indexes.conf -- or $SPLUNK_HOME/etc/apps/search/local/indexes.conf) and add the following to whichever index stanza you want to change:

frozenTimePeriodInSecs = 15778463

Then, restart the indexer for the change to take effect.

See also: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy#Set_att...

Influencer
0 Karma

Community Manager
Community Manager

Hi @jamesvz84

I think you're looking for the frozenTimePeriodInSecs configuration. Here's the relevant documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy#Set_attri...

View solution in original post

Community Manager
Community Manager

Just adding extra info, the default configuration is frozenTimePeriodInSecs=188697600 which is 6 years before data gets rolled to frozen, but the link provided actually uses 180 days (or 15552000 seconds) in the example which is approximately 6 months.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!