We would like to retain data in our indexes by time only. Is this possible? I think I am doing it correctly for our internal index by using the following line, for 90 days:
frozenTimePeriodInSecs = 7776000
Is this correct, and can I use this line to retain indexes solely on time for all indexes, instead on disk size?
Thanks!
Yes, this is correct. However, as a precaution I would also suggest setting maxTotalDataSizeMB
to a reasonably large value so that frozenTimePeriodInSecs
hits before it does.
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!
Yes, this is correct. However, as a precaution I would also suggest setting maxTotalDataSizeMB
to a reasonably large value so that frozenTimePeriodInSecs
hits before it does.
Hope this helps.
> please upvote and accept answer if you find it useful - thanks!
Yes. Splunk will freeze data when either of maxtotaldatasizeMB
or frozenTimePeriodInSecs
is reached first. So, if you reach a size of 500GB (which is the defult maxtotaldatasizeMB
), say, on day 61, old data will be frozen even though it's not 90 days old.
Thanks for answering! Can you explain the need for setting the maxtotaldatasizeMB though? Is it just as a fail safe?