How do I configure a data retention policy and a working script for my indexes?

[sunnyparmar]

Hi,

I want to create a data retention policy for my all indexes, but I don't know how to configure this:
- coldToFrozenDir = "<path to frozen archive>"
- coldToFrozenScript =["<path to program that runs script>"] "<path to script>"
But how do we add this in the indexes.conf file? Can somebody give me the idea of doing this?

Thanks in advance.

[alemarzu · Accepted solution]

Sunnyparmar,

You have to set the frozenTimePeriodInSecs = property for each index. Data will be searchable for the time you specified. And If you do not specify a coldToFrozenScript, data is deleted when rolled to frozen.

[main]

90 days retention

frozenTimePeriodInSecs = 7776000
coldToFrozenScript = "$SPLUNK_HOME/bin/python" "$SPLUNK_HOME/bin/myColdToFrozenScript.py"

[sunnyparmar]

thanks.. will do the same...

[renjith_nair]

Reference :

http://wiki.splunk.com/Deploy:BucketRotationAndRetention

http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Setaretirementandarchivingpolicy

http://docs.splunk.com/Documentation/Splunk/6.1/Admin/indexesconf