How is frozenTimePeriodInSecs applied?

[redc]

Is this applied (or can it be applied) on an index-by-index basis, or does it apply to everything on the indexer? For example, I have one index containing data of a type that I want to freeze after 90 days (7776000 seconds), but another index containing data that I want to keep for as long as possible (for now, 188697600 seconds).

Can I simply add frozenTimePeriodInSecs in indexes.conf to the index I want to truncate earlier and not to the second one (or add it to the second one with the default number of seconds applied)?

E.g.:

[90day_index]
frozenTimePeriodInSecs = 7776000

[forever_index]
frozenTimePeriodInSecs = 188697600

[aelliott · Accepted solution]

You set it in indexes.conf on an index per index basis.
And yes you can do it exactly as you state.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy

[Georgiev]

Bump to working URL: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

[cave_splunker]

Thank you for the link update!

[redc]

Thanks for the speedy response!