Getting Data In

Splunk Index Retention Policy

ram254481493
Explorer

Hi , I implemented the splunk index retention policy for 6 months and it applies suddenly , i got a lot of free space for the data which is in cold location but my data which is in hot bucket and warm didnt change the size , is their any way that i can roll the data from hot/warm location to cold bucket for a certain period interval such as 6 months ? i applied below stanza for my current 6 month retention and it deleted the data older then 6 months , but i have older data in hot/warm bucket and it didnt delete that data : , i really need to remove the 6 month old data from hot location

[xxxx]
homePath   = $SPLUNK_DB/xxxx/db
coldPath   = $SPLUNK_DB/xxxxxx/colddb
thawedPath = $SPLUNK_DB/xxxx/thaweddb
repFactor  = auto
Added This for new retention policy :
maxHotSpanSecs = 86400
frozenTimePeriodInSecs = 15552000
1 Solution

bpadmanbhachari
Splunk Employee
Splunk Employee

You can try setting below parameter for the index

maxHotSpanSecs = (by default it is 90days for hot buckets to roll to warm.
maxWarmDBCount = (by default it is 300, you can reduce this to make warm buckets to roll to cold soon)

View solution in original post

0 Karma

bpadmanbhachari
Splunk Employee
Splunk Employee

You can try setting below parameter for the index

maxHotSpanSecs = (by default it is 90days for hot buckets to roll to warm.
maxWarmDBCount = (by default it is 300, you can reduce this to make warm buckets to roll to cold soon)

0 Karma

ram254481493
Explorer

Thank you so much but 300 means how long time it take to fill 300 buckets , if i keep 50 buckets means how long it will take to roll the buckets from warm to cold , is any calculations is their ?

0 Karma

bpadmanbhachari
Splunk Employee
Splunk Employee

It depends on your amount of data ingestion. If data ingestion is high, then warm buckets will be filling soon to 50, which rolls to cold.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...