Index Retention policy override

[ram254481493]

We have already configured a retention policy of an index which send data to frozen directory after maxDataVolume size reaches (2184 days).Now i want to reduce the retention policy for that index only below to 8 months. I know i have to add FrozenTimePeriodInSecs attribute in my indexes.conf which will take precedence over MaxDataVolumeSize then i will acheive my goal. But my main concern is as we are using the above settings long back if suddenly i change and update the retention policy by overriding it will it create any big issue in my splunk ? If not please tell me and if yes tell me and is it better to do the change ?

[somesoni2 · Accepted solution]

The data retention is applied either based on total size of index (maxTotalDataSizeMB in indexes.conf, if total size of index grows larger than this size, older cold buckets will freeze till size is reduced) OR by age of data (frozenTimePeriodInSecs in indexes.conf, if age of newest data in a cold bucket is older than frozenTimePeriodInSecs, the bucket rolls off to frozen). Now I believe you used the default age base retention period (frozenTimePeriodInSecs=188697600 OR ~6 years or 2184 days) and it was rolling to frozen when size of index was larger than maxTotalDataSizeMB i.e. 500,000MB. Splunk will freeze the bucket when any of the event occurs (event too old or index too large).
There will not be any issues in Splunk if you reduce the data retention period. Splunk would show higher load average for some time as it'll be doing bucket rolling, but other than than, no issues as such.