Change log storage time

[splunkcol]

When the indexes were created, they were created by default.

Now that I needed to know how long a log went from hot to warm bucket and finally to frozen, I have the following question.

1. Is this query correct to know how long it is configured to go to frozen?
| rest / services / data / indexes | fields title froz * | rename title as index

2. If I need it not to store the logs for 6 years, which is the value that I see by default, and I need it to store the logs for 6 months, understanding that when the log reaches 6 months it would go to a frozen state and splunk would begin to eliminate the older data.

3. I should create a file called indexes.conf in the "local" folder and set the value frozenTimePeriodInSecs = 15778800

b Should I go to the bin and restart the splunk service for it to take the changes?

4. Would this change immediately erase logs that are already 6 months old in seconds? or does it start from this moment?

[General_Talos]

1. Is this query correct to know how long it is configured to go to frozen?
| rest / services / data / indexes | fields title froz * | rename title as index

-- Yes SPL is correct

2. If I need it not to store the logs for 6 years, which is the value that I see by default, and I need it to store the logs for 6 months, understanding that when the log reaches 6 months it would go to a frozen state and splunk would begin to eliminate the older data.

-- https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/Setaretirementandarchivingpolicy

The maxTotalDataSizeMB and frozenTimePeriodInSecs attributes in indexes.conf help determine when buckets roll from cold to frozen.

3. I should create a file called indexes.conf in the "local" folder and set the value frozenTimePeriodInSecs = 15778800

-- Yes , 15778800 (seconds) means something near to 6 months (60*60*24*180) and for exact value is 15552000 (considering 30 days in each month).

b Should I go to the bin and restart the splunk service for it to take the changes?

-- Yes, if you are on "standalone infra" Splunk restart required and if you are on a "indexer cluster" a configuration push with rolling restart of all the peer nodes required.

4. Would this change immediately erase logs that are already 6 months old in seconds? or does it start from this moment?

-- Its not very immediate, based on your infra may take 2-10 min (again its based on your Splunk infra).