Deployment Architecture

Splunk index retention based on retention period only not size

Mag2sub
Path Finder

How do we ensure that only say 40 days of data is retained combined across all our buckets hot,warm,cold ....irrespective of incoming data size ..im not interested in 41st day data at any cost ...ie or is it a ballpark calculatioon that can be done based on sizing of these buckets ?

Apreciate pointers

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

FYI, data is not aged out on a per event basis, but on a per bucket basis.

Just be aware that a bucket does not roll to frozen (i.e. is deleted) until the newest event in the bucket is older than the retention limit.

/K

0 Karma

aelliott
Motivator

aelliott
Motivator

you could make maxTotalDataSizeMB a huge number (perhaps the maximum) and use frozenTimePeriodInSecs

Here is a post on this:
http://answers.splunk.com/answers/29126/maxtotaldatasizemb-max-value-or-0

0 Karma

Mag2sub
Path Finder

I guess what is not clear is
is effective delete(provided i dont have freeze dir setup) a combination of frozenTimePeriodInSecs and maxTotalDataSizeMB
or whichever comes first ...

.the idea being from my question if i just dont care my total data size and just need to drop 41st day data irrespective of index total size...i dont see a way in splunk to totally avoid "maxTotalDataSizeMB) and just put frozenTimePeriodInSecs...?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...