Getting Data In

Can we set frozentimePeriodInSecs on a per sourcetype basis?

Explorer

Hi Team,

Is there a way to set frozenTimePeriodInSecs value per sourcetype?
I have the same sourcetype used for multiple sources. Based on our client's requirement, we need to make changes to frozenTimeperiodInSecns based on sourcetype.

Is there a way to make this change?

Thanks

0 Karma

Influencer

frozenTimePeriodinSecs is an indexes.conf configuration. If you need to adjust it per sourcetype, then you need to send the different sourcetypes to different indexes. You could potentially dynamically route the sourcetypes to different indexes as well... See http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Setupmultipleindexes for more info on multiple indexes and this kind of routing.