Index log need to maintain only one year

[balamuruganm7]

Hi Team,

I am seeking help on indexer log retention period set.

I am using splunk enterprise version 6.4.2, deployed some 4 years ago so . indexer log contain more than one year and log to be restricted only one year.

Kindly help on setting indexer log to maintain one year only

[balamuruganm7]

where should I add the default stanza?,where I should add the default stanza?

[masonmorales · Accepted solution]

Assuming that you have removed frozenTimePeriodInSecs at the index-level config of all indexes in your indexes.conf file(s) (use splunk cmd btool indexes list --debug to check), you can do:
indexes.conf

[default]
frozenTimePeriodInSecs = 31536000

[balamuruganm7]

Hi Masonmorales,

I could see indexes.conf file under $SPLUNK_HOME/etc/system/local/, but I don't see any parameter frozenTimePeriodInSecs

indexes.conf files contain following
.
[splunklogger]
bucketRebuildMemoryHint = 0
compressRawdata = 1
enableDataIntegrityControl = 1
enableOnlineBucketRepair =1
enableTsidxReduction = 0
syncMeta =1

[ _internal]
bucketRebuildMemoryHint = 0
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair =1
enableTsidxReduction = 0
syncMeta =1

[ _interospection]

bucketRebuildMemoryHint = 0
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair =1
enableTsidxReduction = 0
syncMeta =1

[ -audit]

bucketRebuildMemoryHint = 0
compressRawdata = 1
enableDataIntegrityControl = 0
enableOnlineBucketRepair =1
enableTsidxReduction = 0
syncMeta =1

[masonmorales]

OK so just add it to the default stanza.

[somesoni2]

Use this to find the current retention applied on the indexes you have:
https://answers.splunk.com/answers/553180/how-to-find-the-retention-period-of-an-index.html

Then follow this to understand and implement appropriate retention period.