I only want to index the last 365 days of data. Can this be done?

[coryjackson]

I only want to index the last 365 days of data. Can this be done in Splunk 4.1? Any data older than one year should be purged from the index.

[vbumgarner]

Configure frozenTimePeriodInSecs in indexes.conf. This is the point at which data is tossed from the index. You will also want to configure maxTotalDataSizeMB to keep your disk from filling. Just in case.

[David]

Additionally, you should make sure the amount of data in each bucket is appropriate. If you have the max time period defined to 365*24*60*60 = 31536000 seconds, it will only delete when the bucket rolls over to warm, and the newest event is older than 1 year.

http://www.splunk.com/wiki/Deploy:UnderstandingBuckets