Getting Data In

Splunk Buckets

vikramyadav
Contributor

Hi,

I have one index(test0) in a standalone server. I'm trying to make
3-month data searchable
after 6 months of data to Archive
And after 12 months of data to delete/retention

Below is my config
[test0]
coldPath = $SPLUNK_DB/test0/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test0/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/test0/thaweddb
maxDataSize = 750
maxWarmDBCount = 500
frozenTimePeriodInSecs = 31556926
coldToFrozenDir = /opt/backup/index

Is above configuration is correct ? 

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @vikramyadav,

Splunk does not manage archived data. With your configuration indexed data will be moved to the archive folder (/opt/backup/index) after one year. The last one-year data will be searchable if your maxTotalDataSizeMB value is enough. If index size exceeds this 512 GB it will be moved to the archive folder.

You can set frozenTimePeriodInSec value to 15552000, in order to archive after 6 months. Also you should calculate 6 months data size to set maxTotalDataSizeMB value.

You have to manually manage archived data with custom script etc for 12 months.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @vikramyadav,

Splunk does not manage archived data. With your configuration indexed data will be moved to the archive folder (/opt/backup/index) after one year. The last one-year data will be searchable if your maxTotalDataSizeMB value is enough. If index size exceeds this 512 GB it will be moved to the archive folder.

You can set frozenTimePeriodInSec value to 15552000, in order to archive after 6 months. Also you should calculate 6 months data size to set maxTotalDataSizeMB value.

You have to manually manage archived data with custom script etc for 12 months.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...