Getting Data In

How do I configure a data retention policy and a working script for my indexes?

sunnyparmar
Communicator

Hi,

I want to create a data retention policy for my all indexes, but I don't know how to configure this:
- coldToFrozenDir = "<path to frozen archive>"
- coldToFrozenScript =["<path to program that runs script>"] "<path to script>"
But how do we add this in the indexes.conf file? Can somebody give me the idea of doing this?

Thanks in advance.

0 Karma
1 Solution

alemarzu
Motivator

Sunnyparmar,

You have to set the frozenTimePeriodInSecs = property for each index. Data will be searchable for the time you specified. And If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen.

[main]

90 days retention

frozenTimePeriodInSecs = 7776000
coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/bin/myColdToFrozenScript.py"

View solution in original post

alemarzu
Motivator

Sunnyparmar,

You have to set the frozenTimePeriodInSecs = property for each index. Data will be searchable for the time you specified. And If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen.

[main]

90 days retention

frozenTimePeriodInSecs = 7776000
coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/bin/myColdToFrozenScript.py"

sunnyparmar
Communicator

thanks.. will do the same...

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...