Getting Data In

How to configure the retention policy for an index to delete data that is one hour old?

SrinivasaC
Path Finder

Hi,

We have an index, and for every half an hour, it's indexing with 350,000 of events. After every ONE Hour, the previous ONE hour of data is no longer required. So, how can I delete that 1 hour old data from the index, or how can we handle this situation to free up my index memory/ index events after every one hour.

  • What would be the minimum retention period for the Index in Hot/Warm/Cold buckets?
  • What would be the minimum Frozen-period for the index?

Thanks in advance.

0 Karma

Yasaswy
Contributor

Hi,
you can try frozenTimePeriodInSecs, rotatePeriodInSecs options.

Eg:
frozenTimePeriodInSecs=3600
rotatePeriodInSecs=30

Also dpeneding on the data size you are receiving you can try other options

maxTotalDataSizeMB
homePath.maxDataSizeMB
coldPath.maxDataSizeMB

check out the spec for options..

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...