Getting Data In
Highlighted

I only want to index the last 365 days of data. Can this be done?

New Member

I only want to index the last 365 days of data. Can this be done in Splunk 4.1? Any data older than one year should be purged from the index.

Tags (1)
0 Karma
Highlighted

Re: I only want to index the last 365 days of data. Can this be done?

Contributor

Configure frozenTimePeriodInSecs in indexes.conf. This is the point at which data is tossed from the index. You will also want to configure maxTotalDataSizeMB to keep your disk from filling. Just in case.

Highlighted

Re: I only want to index the last 365 days of data. Can this be done?

Splunk Employee
Splunk Employee

Additionally, you should make sure the amount of data in each bucket is appropriate. If you have the max time period defined to 3652460*60 = 31536000 seconds, it will only delete when the bucket rolls over to warm, and the newest event is older than 1 year.

http://www.splunk.com/wiki/Deploy:UnderstandingBuckets