Hello,
I have been trying to set an index retention policy on my indexer but it does not seem to be removing any of the older data. I setup a simple stanza for the _internal index to remove data after 30 days and then plan to implement a similar policy to different index types.
Is there something else I need to do other than this in $SPLUNK_HOME/etc/system/local/indexes.conf:
[_internal]
frozenTimePeriodInSecs = 2592000
