Deployment Architecture

How is my data still searchable? Is there something wrong with indexes.conf?

Engager

hi everyone :
i have set indexes.conf link this:

[qt]
coldToFrozenDir = /SplunkBack/splunk/qt
frozenTimePeriodInSecs = 20736000

20736000 = 240 days

but i can still search last year's data。

splunk enterprise = 6.6.3

thinks

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi liuyongkang,
Splunk stores events in buckets, deletion of old events is managed at bucket level.

In other word a bucket is discarded when the newest bucket event is out of the retention period, this means that surely in the same bucket you have last year events and events in the last 240 days.
This bucket will be discarded when the newest event is over 240 days.

see https://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Setaretirementandarchivingpolicy and https://wiki.splunk.com/Deploy:BucketRotationAndRetention

Bye.
Giuseppe

View solution in original post

SplunkTrust
SplunkTrust

Hi liuyongkang,
Splunk stores events in buckets, deletion of old events is managed at bucket level.

In other word a bucket is discarded when the newest bucket event is out of the retention period, this means that surely in the same bucket you have last year events and events in the last 240 days.
This bucket will be discarded when the newest event is over 240 days.

see https://docs.splunk.com/Documentation/Splunk/6.6.3/Indexer/Setaretirementandarchivingpolicy and https://wiki.splunk.com/Deploy:BucketRotationAndRetention

Bye.
Giuseppe

View solution in original post

Engager

Hi Giuseppe,
think you my friend, let me have a try.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!