Getting Data In

2 year retention policy


Hi guy, how do I go about setting a limit on our data retention.

I need the data on the indexer to be deleted after 2 years, is there a way to do tjis via the web interface or is this somthing that must be done in the inputs.conf on the indexer itself.

Also am I correct in thinking that you have to define the time in seconds if going down the inputs.conf route ?



Tags (2)
0 Karma


No, that's not really correct.

You should have a look at the following reference:

But at a highlevel you will need to use the frozenTimePeriodInSecs parameter for each Index stanza OR globally in your indexes.conf file.

Hope this helps.

P.S. Plan this change correctly... you may lose your data incorrectly... would be a good idea to do a backup of data first!

0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...