Getting Data In

Retention index or log 90 days

jirakritwang
Engager

Hi. I use Splunk 6.1 free version, Can i config splunk for keep index or log 90 days and delete index or log older than 90 days.

Thank you.
Jira

Tags (1)

Ayn
Legend

Yes. Check out the frozenTimePeriodInSecs setting in indexes.conf. By setting this to 7776000 (90 days in seconds) Splunk will delete data in its index when it becomes older than this limit. You're asking about deleting "index or log" - not sure what you mean by that, but Splunk will not delete any of the actual log files that it's read data from, that's something you need to set up separately.

http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Indexesconf

somesoni2
Revered Legend

The data older than frozenTimePeriodInSecs will get deleted from Splunk. This setting is per index, not global. Setting a higher value of frozenTimePeriodInSecs for summary indexes will ensure that summary index data is retained for longer period.

0 Karma

dhavamanis
Builder

Thank you!, i want to delete the indexed data / log. Sorry for the confusion. seems this frozenTimePeriodInSecs needs to enable per index, not for global. can you please confirm?. Also can you please provide the steps to retain summary index as historical data.

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...