Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Re: Splunk index retention based on retention per...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk index retention based on retention period only not size
How do we ensure that only say 40 days of data is retained combined across all our buckets hot,warm,cold ....irrespective of incoming data size ..im not interested in 41st day data at any cost ...ie or is it a ballpark calculatioon that can be done based on sizing of these buckets ?
Apreciate pointers
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FYI, data is not aged out on a per event basis, but on a per bucket basis.
Just be aware that a bucket does not roll to frozen (i.e. is deleted) until the newest event in the bucket is older than the retention limit.
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This information may assist you:
http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you could make maxTotalDataSizeMB a huge number (perhaps the maximum) and use frozenTimePeriodInSecs
Here is a post on this:
http://answers.splunk.com/answers/29126/maxtotaldatasizemb-max-value-or-0
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I guess what is not clear is
is effective delete(provided i dont have freeze dir setup) a combination of frozenTimePeriodInSecs and maxTotalDataSizeMB
or whichever comes first ...
.the idea being from my question if i just dont care my total data size and just need to drop 41st day data irrespective of index total size...i dont see a way in splunk to totally avoid "maxTotalDataSizeMB) and just put frozenTimePeriodInSecs...?
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
