Getting Data In

How to implement a new Retention Policy, and what changes take effect after restarting Splunk?

qiaojing
Path Finder

Hi,

I'm currently researching on the use of Retention Policy on Splunk by setting it to only keep data for 6 months. I will most likely be editing frozenTimePeriodInSecs attribute in indexes.conf. The attribute is currently set to default (which is 6 years I think).

I have a few questions regarding the implementation of the retention policy and I can't seem to find the answer online.

May I know after I make the changes to indexes.conf and restart Splunk.
- Does the change take effect immediately?
- What happens to the old data (eg those older than 6 months), will the old data be deleted immediately after restarting?
- Do I have to create the indexes.conf file, or is it already stored inside the server?
- Does this change affect all the buckets, or only those older data in the warm/cold buckets?

I'm using Splunk to do some automated housekeeping for my log data and I wish to know more about it.

Any help will be greatly appreciated. Thank you.

0 Karma
1 Solution

woodcock
Esteemed Legend

Yes, the changes are in effect immediately and old data will be frozen (deleted) if necessary to meet the requirements of the new settings. Your indexers definitely should come with an indexes.conf file.
Hot buckets cannot be frozen so it will only be warm buckets (cold is frozen already).
Keep in mind that this has NOTHING to do with deleting the original files that you are forwarding with monitor configurations in inputs.conf.

View solution in original post

woodcock
Esteemed Legend

Yes, the changes are in effect immediately and old data will be frozen (deleted) if necessary to meet the requirements of the new settings. Your indexers definitely should come with an indexes.conf file.
Hot buckets cannot be frozen so it will only be warm buckets (cold is frozen already).
Keep in mind that this has NOTHING to do with deleting the original files that you are forwarding with monitor configurations in inputs.conf.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!