2 year retention policy

[AaronMoorcroft]

Hi guy, how do I go about setting a limit on our data retention.

I need the data on the indexer to be deleted after 2 years, is there a way to do tjis via the web interface or is this somthing that must be done in the inputs.conf on the indexer itself.

Also am I correct in thinking that you have to define the time in seconds if going down the inputs.conf route ?

Cheers

Aaron

[MHibbin]

No, that's not really correct.

You should have a look at the following reference:

http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy

But at a highlevel you will need to use the frozenTimePeriodInSecs parameter for each Index stanza OR globally in your indexes.conf file.

http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Indexesconf

Hope this helps.

P.S. Plan this change correctly... you may lose your data incorrectly... would be a good idea to do a backup of data first!