Getting Data In

Index Retention policy override

ram254481493
Explorer

We have already configured a retention policy of an index which send data to frozen directory after maxDataVolume size reaches (2184 days).Now i want to reduce the retention policy for that index only below to 8 months. I know i have to add FrozenTimePeriodInSecs attribute in my indexes.conf which will take precedence over MaxDataVolumeSize then i will acheive my goal. But my main concern is as we are using the above settings long back if suddenly i change and update the retention policy by overriding it will it create any big issue in my splunk ? If not please tell me and if yes tell me and is it better to do the change ?

0 Karma
1 Solution

somesoni2
Revered Legend

The data retention is applied either based on total size of index (maxTotalDataSizeMB in indexes.conf, if total size of index grows larger than this size, older cold buckets will freeze till size is reduced) OR by age of data (frozenTimePeriodInSecs in indexes.conf, if age of newest data in a cold bucket is older than frozenTimePeriodInSecs, the bucket rolls off to frozen). Now I believe you used the default age base retention period (frozenTimePeriodInSecs=188697600 OR ~6 years or 2184 days) and it was rolling to frozen when size of index was larger than maxTotalDataSizeMB i.e. 500,000MB. Splunk will freeze the bucket when any of the event occurs (event too old or index too large).
There will not be any issues in Splunk if you reduce the data retention period. Splunk would show higher load average for some time as it'll be doing bucket rolling, but other than than, no issues as such.

View solution in original post

0 Karma

somesoni2
Revered Legend

The data retention is applied either based on total size of index (maxTotalDataSizeMB in indexes.conf, if total size of index grows larger than this size, older cold buckets will freeze till size is reduced) OR by age of data (frozenTimePeriodInSecs in indexes.conf, if age of newest data in a cold bucket is older than frozenTimePeriodInSecs, the bucket rolls off to frozen). Now I believe you used the default age base retention period (frozenTimePeriodInSecs=188697600 OR ~6 years or 2184 days) and it was rolling to frozen when size of index was larger than maxTotalDataSizeMB i.e. 500,000MB. Splunk will freeze the bucket when any of the event occurs (event too old or index too large).
There will not be any issues in Splunk if you reduce the data retention period. Splunk would show higher load average for some time as it'll be doing bucket rolling, but other than than, no issues as such.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...