Hi,
I want to create a data retention policy for my all indexes, but I don't know how to configure this:
- coldToFrozenDir = "<path to frozen archive>"
- coldToFrozenScript =["<path to program that runs script>"] "<path to script>"
But how do we add this in the indexes.conf file? Can somebody give me the idea of doing this?
Thanks in advance.
Sunnyparmar,
You have to set the frozenTimePeriodInSecs = property for each index. Data will be searchable for the time you specified. And If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen.
[main]
frozenTimePeriodInSecs = 7776000
coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/bin/myColdToFrozenScript.py"
Sunnyparmar,
You have to set the frozenTimePeriodInSecs = property for each index. Data will be searchable for the time you specified. And If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen.
[main]
frozenTimePeriodInSecs = 7776000
coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/bin/myColdToFrozenScript.py"
thanks.. will do the same...