Getting Data In

Index Retention by Time Only

aferone
Builder

We would like to retain data in our indexes by time only. Is this possible? I think I am doing it correctly for our internal index by using the following line, for 90 days:

frozenTimePeriodInSecs = 7776000

Is this correct, and can I use this line to retain indexes solely on time for all indexes, instead on disk size?

Thanks!

Tags (2)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

Yes, this is correct. However, as a precaution I would also suggest setting maxTotalDataSizeMB to a reasonably large value so that frozenTimePeriodInSecs hits before it does.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

_d_
Splunk Employee
Splunk Employee

Yes, this is correct. However, as a precaution I would also suggest setting maxTotalDataSizeMB to a reasonably large value so that frozenTimePeriodInSecs hits before it does.

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

_d_
Splunk Employee
Splunk Employee

Yes. Splunk will freeze data when either of maxtotaldatasizeMB or frozenTimePeriodInSecs is reached first. So, if you reach a size of 500GB (which is the defult maxtotaldatasizeMB), say, on day 61, old data will be frozen even though it's not 90 days old.

0 Karma

aferone
Builder

Thanks for answering! Can you explain the need for setting the maxtotaldatasizeMB though? Is it just as a fail safe?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...