How to implement a new Retention Policy, and what changes take effect after restarting Splunk?

[qiaojing]

Hi,

I'm currently researching on the use of Retention Policy on Splunk by setting it to only keep data for 6 months. I will most likely be editing frozenTimePeriodInSecs attribute in indexes.conf. The attribute is currently set to default (which is 6 years I think).

I have a few questions regarding the implementation of the retention policy and I can't seem to find the answer online.

May I know after I make the changes to indexes.conf and restart Splunk.
- Does the change take effect immediately?
- What happens to the old data (eg those older than 6 months), will the old data be deleted immediately after restarting?
- Do I have to create the indexes.conf file, or is it already stored inside the server?
- Does this change affect all the buckets, or only those older data in the warm/cold buckets?

I'm using Splunk to do some automated housekeeping for my log data and I wish to know more about it.

Any help will be greatly appreciated. Thank you.

[woodcock · Accepted solution]

Yes, the changes are in effect immediately and old data will be frozen (deleted) if necessary to meet the requirements of the new settings. Your indexers definitely should come with an indexes.conf file.
Hot buckets cannot be frozen so it will only be warm buckets (cold is frozen already).
Keep in mind that this has NOTHING to do with deleting the original files that you are forwarding with monitor configurations in inputs.conf.