Logs Retention

[BRFZ]

Hello,
Is it possible to define the retention duration of logs (hot, warm and cold)  If yes, how can this be done ? Or do we only have the option to define the frozenTimePeriodInSecs ?

[gcusello]

Hi @BRFZ 

yes, see at https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Indexesconf

anyway, frozenTimeperiodInSecs is the all retention time (Hot+Warm+Cold), maxHotSpanSecs is the Hot+Warm period.

Ciao.

Giuseppe