Getting Data In

Index Retention policy override

ram254481493
Explorer

We have already configured a retention policy of an index which send data to frozen directory after maxDataVolume size reaches (2184 days).Now i want to reduce the retention policy for that index only below to 8 months. I know i have to add FrozenTimePeriodInSecs attribute in my indexes.conf which will take precedence over MaxDataVolumeSize then i will acheive my goal. But my main concern is as we are using the above settings long back if suddenly i change and update the retention policy by overriding it will it create any big issue in my splunk ? If not please tell me and if yes tell me and is it better to do the change ?

0 Karma
1 Solution

somesoni2
Revered Legend

The data retention is applied either based on total size of index (maxTotalDataSizeMB in indexes.conf, if total size of index grows larger than this size, older cold buckets will freeze till size is reduced) OR by age of data (frozenTimePeriodInSecs in indexes.conf, if age of newest data in a cold bucket is older than frozenTimePeriodInSecs, the bucket rolls off to frozen). Now I believe you used the default age base retention period (frozenTimePeriodInSecs=188697600 OR ~6 years or 2184 days) and it was rolling to frozen when size of index was larger than maxTotalDataSizeMB i.e. 500,000MB. Splunk will freeze the bucket when any of the event occurs (event too old or index too large).
There will not be any issues in Splunk if you reduce the data retention period. Splunk would show higher load average for some time as it'll be doing bucket rolling, but other than than, no issues as such.

View solution in original post

0 Karma

somesoni2
Revered Legend

The data retention is applied either based on total size of index (maxTotalDataSizeMB in indexes.conf, if total size of index grows larger than this size, older cold buckets will freeze till size is reduced) OR by age of data (frozenTimePeriodInSecs in indexes.conf, if age of newest data in a cold bucket is older than frozenTimePeriodInSecs, the bucket rolls off to frozen). Now I believe you used the default age base retention period (frozenTimePeriodInSecs=188697600 OR ~6 years or 2184 days) and it was rolling to frozen when size of index was larger than maxTotalDataSizeMB i.e. 500,000MB. Splunk will freeze the bucket when any of the event occurs (event too old or index too large).
There will not be any issues in Splunk if you reduce the data retention period. Splunk would show higher load average for some time as it'll be doing bucket rolling, but other than than, no issues as such.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...