Getting Data In

Splunk Buckets

vikramyadav
Contributor

Hi,

I have one index(test0) in a standalone server. I'm trying to make
3-month data searchable
after 6 months of data to Archive
And after 12 months of data to delete/retention

Below is my config
[test0]
coldPath = $SPLUNK_DB/test0/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test0/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/test0/thaweddb
maxDataSize = 750
maxWarmDBCount = 500
frozenTimePeriodInSecs = 31556926
coldToFrozenDir = /opt/backup/index

Is above configuration is correct ? 

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @vikramyadav,

Splunk does not manage archived data. With your configuration indexed data will be moved to the archive folder (/opt/backup/index) after one year. The last one-year data will be searchable if your maxTotalDataSizeMB value is enough. If index size exceeds this 512 GB it will be moved to the archive folder.

You can set frozenTimePeriodInSec value to 15552000, in order to archive after 6 months. Also you should calculate 6 months data size to set maxTotalDataSizeMB value.

You have to manually manage archived data with custom script etc for 12 months.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @vikramyadav,

Splunk does not manage archived data. With your configuration indexed data will be moved to the archive folder (/opt/backup/index) after one year. The last one-year data will be searchable if your maxTotalDataSizeMB value is enough. If index size exceeds this 512 GB it will be moved to the archive folder.

You can set frozenTimePeriodInSec value to 15552000, in order to archive after 6 months. Also you should calculate 6 months data size to set maxTotalDataSizeMB value.

You have to manually manage archived data with custom script etc for 12 months.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...