Splunk index retention based on retention period only not size

[Mag2sub]

How do we ensure that only say 40 days of data is retained combined across all our buckets hot,warm,cold ....irrespective of incoming data size ..im not interested in 41st day data at any cost ...ie or is it a ballpark calculatioon that can be done based on sizing of these buckets ?

Apreciate pointers

[kristian_kolb]

FYI, data is not aged out on a per event basis, but on a per bucket basis.

Just be aware that a bucket does not roll to frozen (i.e. is deleted) until the newest event in the bucket is older than the retention limit.

/K

[aelliott]

This information may assist you:
http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy

[aelliott]

you could make maxTotalDataSizeMB a huge number (perhaps the maximum) and use frozenTimePeriodInSecs

Here is a post on this:
http://answers.splunk.com/answers/29126/maxtotaldatasizemb-max-value-or-0

[Mag2sub]

I guess what is not clear is
is effective delete(provided i dont have freeze dir setup) a combination of frozenTimePeriodInSecs and maxTotalDataSizeMB
or whichever comes first ...

.the idea being from my question if i just dont care my total data size and just need to drop 41st day data irrespective of index total size...i dont see a way in splunk to totally avoid "maxTotalDataSizeMB) and just put frozenTimePeriodInSecs...?