How to configure indexes.conf for bucket retention and rotation policy?

[romitsn]

I have an index called "sharp" where currently I have ~ 90 days worth of data in the hotbucket (db directory).

For 90 days worth of data it takes up about 130 gigs of space.

I want to bucket retention and rotation in such a way-
upto 90 days worth of index files = stays in hot bucket ( we should be able to search up to 90 days' data)
more than 90 days worth of index files = can be moved to frozen (can be deleted immediately)

What are the settings I should use in the indexes.conf file?

[somesoni2]

You can set the frozenTimePeriodInSecs property for the index to 7776000 (90 days). The data will be available in Splunk for 90 days and will be move to frozen (deleted unless set a script to archieve it).

Reference.

http://answers.splunk.com/answers/143716/retention-index-or-log-90-days

http://wiki.splunk.com/Deploy:BucketRotationAndRetention