Getting Data In

Splunk Buckets

vikramyadav
Contributor

Hi,

I have one index(test0) in a standalone server. I'm trying to make
3-month data searchable
after 6 months of data to Archive
And after 12 months of data to delete/retention

Below is my config
[test0]
coldPath = $SPLUNK_DB/test0/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test0/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/test0/thaweddb
maxDataSize = 750
maxWarmDBCount = 500
frozenTimePeriodInSecs = 31556926
coldToFrozenDir = /opt/backup/index

Is above configuration is correct ? 

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @vikramyadav,

Splunk does not manage archived data. With your configuration indexed data will be moved to the archive folder (/opt/backup/index) after one year. The last one-year data will be searchable if your maxTotalDataSizeMB value is enough. If index size exceeds this 512 GB it will be moved to the archive folder.

You can set frozenTimePeriodInSec value to 15552000, in order to archive after 6 months. Also you should calculate 6 months data size to set maxTotalDataSizeMB value.

You have to manually manage archived data with custom script etc for 12 months.

If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @vikramyadav,

Splunk does not manage archived data. With your configuration indexed data will be moved to the archive folder (/opt/backup/index) after one year. The last one-year data will be searchable if your maxTotalDataSizeMB value is enough. If index size exceeds this 512 GB it will be moved to the archive folder.

You can set frozenTimePeriodInSec value to 15552000, in order to archive after 6 months. Also you should calculate 6 months data size to set maxTotalDataSizeMB value.

You have to manually manage archived data with custom script etc for 12 months.

If this reply helps you an upvote is appreciated.
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...