Getting Data In

How to configure the retention policy for an index to delete data that is one hour old?

SrinivasaC
Path Finder

Hi,

We have an index, and for every half an hour, it's indexing with 350,000 of events. After every ONE Hour, the previous ONE hour of data is no longer required. So, how can I delete that 1 hour old data from the index, or how can we handle this situation to free up my index memory/ index events after every one hour.

  • What would be the minimum retention period for the Index in Hot/Warm/Cold buckets?
  • What would be the minimum Frozen-period for the index?

Thanks in advance.

0 Karma

Yasaswy
Contributor

Hi,
you can try frozenTimePeriodInSecs, rotatePeriodInSecs options.

Eg:
frozenTimePeriodInSecs=3600
rotatePeriodInSecs=30

Also dpeneding on the data size you are receiving you can try other options

maxTotalDataSizeMB
homePath.maxDataSizeMB
coldPath.maxDataSizeMB

check out the spec for options..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...