Hello,
Is it possible to define the retention duration of logs (hot, warm and cold) If yes, how can this be done ? Or do we only have the option to define the frozenTimePeriodInSecs ?
Hi @BRFZ
yes, see at https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Indexesconf
anyway, frozenTimeperiodInSecs is the all retention time (Hot+Warm+Cold), maxHotSpanSecs is the Hot+Warm period.
Ciao.
Giuseppe