Splunk Buckets

[vikramyadav]

Hi,

I have one index(test0) in a standalone server. I'm trying to make
3-month data searchable
after 6 months of data to Archive
And after 12 months of data to delete/retention

Below is my config
[test0]
coldPath = $SPLUNK_DB/test0/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/test0/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/test0/thaweddb
maxDataSize = 750
maxWarmDBCount = 500
frozenTimePeriodInSecs = 31556926
coldToFrozenDir = /opt/backup/index

Is above configuration is correct ? 

[scelikok · Accepted solution]

Hi @vikramyadav,

Splunk does not manage archived data. With your configuration indexed data will be moved to the archive folder (/opt/backup/index) after one year. The last one-year data will be searchable if your maxTotalDataSizeMB value is enough. If index size exceeds this 512 GB it will be moved to the archive folder.

You can set frozenTimePeriodInSec value to 15552000, in order to archive after 6 months. Also you should calculate 6 months data size to set maxTotalDataSizeMB value.

You have to manually manage archived data with custom script etc for 12 months.