I have created an index called "mysummary" for my Splunk app, and I want this index to store 90 days worth of data, so I have used the following configuration. i.e. at any time, I need to store only 90 days worth of data in this index.
I have seen the attribute "rotatePeriodInSecs" added to do the regular checks and roll the data after 90 days from the index and make it preserve only 90 days worth of data, but it's still not working as expected.
Thanks for the update . I Have used the same setting previously but it didn't work as expected and could see data being there in my index more than 90 days. So only introduced these 2 attributes maxHotSpanSecs and rotatePeriodInSecs. Is this something you tested and working for u ??
I never used maxHotSpanSecs and rotatePeriodInSecs to be completely honest. Using rotatePeriodInSecs with the value of "60" shouldn't cause any problems. Using maxHotSpanSecs in an indexer stanza with values that aren't default I would never do.
The Stanza I gave you is exactly the stanza I use for my indexes on the splunk instances at work. And It works fine there, indexed data is kept around as long as the frozenTimePeriodInSecs parameter is set to.