Deployment Architecture

Index Retention



If I just mention frozenTimePeriodInSecs as 30 days , how does Splunk roll the buckets exactly so that the data gets deleted in 30 days ?

Will adding the parameters like homePath.maxDataSizeMB , coldPath.maxDataSizeMB effect the rolling of buckets ?

0 Karma


Retention time refers to the newest event in a bucket. If a bucket typically holds 7 days of data, for example, then it will not be deleted until it is 37 days old because the last event written to it must be at least 30 days old.

The size constraints are considered separately. If an index reaches its size limit, the oldest buckets will be deleted until the index is within the size limit. This means buckets may be frozen before 30 days.

If this reply helps you, Karma would be appreciated.


Thanks for the answer @richgalloway,

But the parameter frozenTimePeriodInSecs applies to cold buckets , there are bucket stages in between. How does Splunk organize the rolling so that data falls into the cold and retention is applied

What if the data volume is low and is present only in the hot and warm buckets itself and didn't come into cold still and the period has exceeded 30 days ?
So the retention policy will not apply in this case ??

0 Karma

Ultra Champion

frozenTimePeriodInSecs is actually the time from creation to frozen, regardless of the stages in between.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...