Hi,
I want to create a data retention policy for my all indexes, but I don't know how to configure this:
- coldToFrozenDir = "<path to frozen archive>"
- coldToFrozenScript =["<path to program that runs script>"] "<path to script>"
But how do we add this in the indexes.conf file? Can somebody give me the idea of doing this?
Thanks in advance.
Sunnyparmar,
You have to set the frozenTimePeriodInSecs = property for each index. Data will be searchable for the time you specified. And If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen.
[main]
frozenTimePeriodInSecs = 7776000
coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/bin/myColdToFrozenScript.py"
Sunnyparmar,
You have to set the frozenTimePeriodInSecs = property for each index. Data will be searchable for the time you specified. And If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen.
[main]
frozenTimePeriodInSecs = 7776000
coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/bin/myColdToFrozenScript.py"
thanks.. will do the same...
Reference :
http://wiki.splunk.com/Deploy:BucketRotationAndRetention
http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Setaretirementandarchivingpolicy
http://docs.splunk.com/Documentation/Splunk/6.1/Admin/indexesconf