Getting Data In

Can we store data in our Splunk indexes forever particular index?

ssuluguri
Path Finder

Hi guys,

 

Do we have an option to store data forever in either of buckets (warm or cold) for particular index ?

 

If yes can some share the stanza .

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no "keep forever" setting in indexes.conf.  Set frozenTimePeriodInSecs, maxTotalDataSizeMB, and maxVolumeDataSizeMB (if using volumes) to their maximum values.  Then keep an eye on your storage.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...