How to reduce historical data length?

[echojacques]

My main Splunk index is near it's max size (~500GB). Instead of filtering out more data (nullQueue) I'd like to look into the possibility of reducing the amount of historical data it stores (store 2 months of events instead of 3 months). I've heard that some people configure Splunk to keep 6 months and others keep just 1 month. Where can I check and possibly modify this?

Thanks.

[yannK · Accepted solution]

Yes it' s possible to setup any bucket retention time, based on the timestamp of the events in the bucket.

check the setting frozenTimePeriodInSecs in indexes.conf (default is ~ 6 years)
see http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/Configureindexstorage

[kristian_kolb]

well. you can just leave it as it is, and it will automatically delete the oldest buckets as needed to stay within the 500GB limit.

[echojacques]

Awesome, thanks. We index millions of events/day (and would need many, many terabytes to index over a year) so I have reduced mine from 90 days to 60 days.