How to increase log retention period for one of the indexes to one year?

[hrithiktej]

[my_index]
coldPath = volume:primary/my_index/colddb
homePath = volume:primary/my_index/db
thawedPath = $SPLUNK_DB/my_index/thaweddb
frozenTimePeriodInSecs = 31536000
maxTotalDataSizeMB = 1000000

As per above configuration, data should be retained for 1 year if it does not exceed the maximum size (976.56 GB ) of the bucket.
Is this right?

[ddrillic]

-- if it does not exceed the maximum size (976.56 GB ) of bucket
of the index...

[isoutamo]

And/or there has not been set coldPath.maxDataSizeMB something else than 0. And of course there are enough space on device.

You could check those values from cmd line:
splunk btool indexes my_index [--debug]

r. Ismo

[mayurr98 · Accepted solution]

hey, yes you are right

As per the doc

maxTotalDataSizeMB = <nonnegative integer>
* The maximum size of an index (in MB).
* If an index grows larger than the maximum size, the oldest data is frozen.
* This parameter only applies to hot, warm, and cold buckets.  It does not
  apply to thawed buckets.
* Highest legal value is 4294967295
* Defaults to 500000.

frozenTimePeriodInSecs = <nonnegative integer>
* Number of seconds after which indexed data rolls to frozen.
* If you do not specify a coldToFrozenScript, data is deleted when rolled to
  frozen.
* IMPORTANT: Every event in the DB must be older than frozenTimePeriodInSecs
  before it will roll. Then, the DB will be frozen the next time splunkd
  checks (based on rotatePeriodInSecs attribute).
* Highest legal value is 4294967295
* Defaults to 188697600 (6 years).

Have a look at this doc for more info.
http://docs.splunk.com/Documentation/Splunk/7.0.2/admin/Indexesconf

let me know if this helps!