Getting Data In

How to set data retention in indexes.conf

Splunk Employee
Splunk Employee

Hello,

I have been trying to set an index retention policy on my indexer but it does not seem to be removing any of the older data. I setup a simple stanza for the _internal index to remove data after 30 days and then plan to implement a similar policy to different index types.

Is there something else I need to do other than this in $SPLUNK_HOME/etc/system/local/indexes.conf:

[_internal]
frozenTimePeriodInSecs = 2592000

0 Karma

Splunk Employee
Splunk Employee

It would help if the path was correct where I specified the db!

0 Karma