can we change index retention at any time?

[AzmathShaik]

Hello All,

we have multisite cluster environment running our current retention is set to default, can we change our retention now, is it suggested to do? what will be the impact.

[s2_splunk · Accepted solution]

Yes, you can change retention settings for your indices at any time. If you reduce it, Splunk will start rolling off data based on your index configuration.
If you increase it, buckets will be kept longer, according to new retention settings. In this case, make sure you have enough storage across your indexing tier to maintain the longer data retention.

Impact:
- the change requires a rolling restart of your cluster
- if you decrease retention, Splunk will process all buckets to determine which ones should now be archived/deleted. This may take a while, but should not have material impact on indexing and search otherwise

[AzmathShaik]

Thank you.

[evgenyvasilchen]

If we decrease retention - shall this free some disk space?
For example - we have accumulated data for 5 years and now want to set max. retention time to 2 years.
So, if we will set frozenTimePeriodInSecs to two years - will that remove any older buckets off the disk?

Thanks!

[dxu_splunk]

^ yes it will. it'll likely use a lot of resources free'ing up so many buckets upon the first restart.