Purge data - only keep last 7 days

[tb5821]

How do I setup splunk to purge anything older than 7 days?

[alacercogitatus · Accepted solution]

You'll want to review this doc: http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy. You can set retention on a per-index basis, and set the cold to Frozen at 7 days.