Is it possible to truncate data in an index eg. delete all events that are older than 60 days, and if how?

[preben12]

Is it possible to truncate data in a index eg. delete all events that are older than 60 days, and if how ?
Can it be scheduled ?

[Ayn · Accepted solution]

http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Setaretirementandarchivingpolicy

[danks]

Link no longer works. Why does this keep moving around?

[inventsekar]

https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Setaretirementandarchivingpolicy

the URL contains the Splunk version number in it, right.. just update that to your required splunk version, .. you will get the doc you are looking for. thats it.. simple, right?!?!