Getting Data In

Data Base Retention Adjustment

opel121
New Member

Hi All

I want to set my Splunk server to keep logs active for 30 days then compress those logs, save it in another directory active for 90 days.

what i know after some searches that all that configuration can be done from indexex.conf file but i didn't understand what is hot, cold & frozen, what is maxhotIdlesecs??

little help will be appreciated.

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>