Getting Data In

Logs Retention

BRFZ
Path Finder

Hello,
Is it possible to define the retention duration of logs (hot, warm and cold)  If yes, how can this be done ? Or do we only have the option to define the frozenTimePeriodInSecs ?

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @BRFZ 

yes, see at https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Indexesconf

anyway, frozenTimeperiodInSecs is the all retention time (Hot+Warm+Cold), maxHotSpanSecs is the Hot+Warm period.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...

New Splunk Innovations Enhance Performance and Accelerate Troubleshooting

Splunk is excited to announce new releases that empower ITOps and engineering teams to stay ahead in ever ...