- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Logs Retention
BRFZ
Path Finder
06-20-2024
12:47 AM
Hello,
Is it possible to define the retention duration of logs (hot, warm and cold) If yes, how can this be done ? Or do we only have the option to define the frozenTimePeriodInSecs ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

gcusello

SplunkTrust
06-20-2024
01:18 AM
Hi @BRFZ
yes, see at https://docs.splunk.com/Documentation/Splunk/9.2.1/Admin/Indexesconf
anyway, frozenTimeperiodInSecs is the all retention time (Hot+Warm+Cold), maxHotSpanSecs is the Hot+Warm period.
Ciao.
Giuseppe
