Getting Data In

Index Retention by Time Only

aferone
Builder

We would like to retain data in our indexes by time only. Is this possible? I think I am doing it correctly for our internal index by using the following line, for 90 days:

frozenTimePeriodInSecs = 7776000

Is this correct, and can I use this line to retain indexes solely on time for all indexes, instead on disk size?

Thanks!

Tags (2)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

Yes, this is correct. However, as a precaution I would also suggest setting maxTotalDataSizeMB to a reasonably large value so that frozenTimePeriodInSecs hits before it does.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

_d_
Splunk Employee
Splunk Employee

Yes, this is correct. However, as a precaution I would also suggest setting maxTotalDataSizeMB to a reasonably large value so that frozenTimePeriodInSecs hits before it does.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

_d_
Splunk Employee
Splunk Employee

Yes. Splunk will freeze data when either of maxtotaldatasizeMB or frozenTimePeriodInSecs is reached first. So, if you reach a size of 500GB (which is the defult maxtotaldatasizeMB), say, on day 61, old data will be frozen even though it's not 90 days old.

0 Karma

aferone
Builder

Thanks for answering! Can you explain the need for setting the maxtotaldatasizeMB though? Is it just as a fail safe?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...