Getting Data In

Retention index or log 90 days

jirakritwang
Engager

Hi. I use Splunk 6.1 free version, Can i config splunk for keep index or log 90 days and delete index or log older than 90 days.

Thank you.
Jira

Tags (1)

Ayn
Legend

Yes. Check out the frozenTimePeriodInSecs setting in indexes.conf. By setting this to 7776000 (90 days in seconds) Splunk will delete data in its index when it becomes older than this limit. You're asking about deleting "index or log" - not sure what you mean by that, but Splunk will not delete any of the actual log files that it's read data from, that's something you need to set up separately.

http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Indexesconf

somesoni2
Revered Legend

The data older than frozenTimePeriodInSecs will get deleted from Splunk. This setting is per index, not global. Setting a higher value of frozenTimePeriodInSecs for summary indexes will ensure that summary index data is retained for longer period.

0 Karma

dhavamanis
Builder

Thank you!, i want to delete the indexed data / log. Sorry for the confusion. seems this frozenTimePeriodInSecs needs to enable per index, not for global. can you please confirm?. Also can you please provide the steps to retain summary index as historical data.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...