Getting Data In

Splunk Index Retention Policy

Explorer

Hi , I implemented the splunk index retention policy for 6 months and it applies suddenly , i got a lot of free space for the data which is in cold location but my data which is in hot bucket and warm didnt change the size , is their any way that i can roll the data from hot/warm location to cold bucket for a certain period interval such as 6 months ? i applied below stanza for my current 6 month retention and it deleted the data older then 6 months , but i have older data in hot/warm bucket and it didnt delete that data : , i really need to remove the 6 month old data from hot location

[xxxx]
homePath   = $SPLUNK_DB/xxxx/db
coldPath   = $SPLUNK_DB/xxxxxx/colddb
thawedPath = $SPLUNK_DB/xxxx/thaweddb
repFactor  = auto
Added This for new retention policy :
maxHotSpanSecs = 86400
frozenTimePeriodInSecs = 15552000
1 Solution

Splunk Employee
Splunk Employee

You can try setting below parameter for the index

maxHotSpanSecs = (by default it is 90days for hot buckets to roll to warm.
maxWarmDBCount = (by default it is 300, you can reduce this to make warm buckets to roll to cold soon)

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

You can try setting below parameter for the index

maxHotSpanSecs = (by default it is 90days for hot buckets to roll to warm.
maxWarmDBCount = (by default it is 300, you can reduce this to make warm buckets to roll to cold soon)

View solution in original post

0 Karma

Explorer

Thank you so much but 300 means how long time it take to fill 300 buckets , if i keep 50 buckets means how long it will take to roll the buckets from warm to cold , is any calculations is their ?

0 Karma

Splunk Employee
Splunk Employee

It depends on your amount of data ingestion. If data ingestion is high, then warm buckets will be filling soon to 50, which rolls to cold.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!