- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Trim an index down to 90 days and recover space
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So say I have an index that's got data in it back 120 Days, and I want to delete events older than 90 days, keeping the indexes trimmed to 90 days going forward. Would the below process accomplish this?
Set indexes.conf:
[indexname]
frozenTimePeriodInSecs = 7776000
restart splunk
I'm assuming that if I restart splunk, it will automatically go through and start deleting stuff older than 90 days on its own. Is this correct?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One thing to keep in mind is that a bucket won't transition over to frozen until ALL events in the bucket exceed the timeframe given. On low volume indexes, it's possible for a bucket to have data from a wider date range, and thus would hang around longer than expected.
Another way to approach this is to estimate how much data you index in the time period desired, and then set the maxTotalDataSizeMB accordingly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One thing to keep in mind is that a bucket won't transition over to frozen until ALL events in the bucket exceed the timeframe given. On low volume indexes, it's possible for a bucket to have data from a wider date range, and thus would hang around longer than expected.
Another way to approach this is to estimate how much data you index in the time period desired, and then set the maxTotalDataSizeMB accordingly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can, and both will apply. So it will freeze buckets that go past the expiration time, or when the total index exceeds the size parameter. Whichever comes first.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you set both the max size and time?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes that's right. Be VERY careful with that. Getting a few numbers wrong could let you lose a LOT of data fast 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes 🙂 At least thats the what happened on the index I just tried this.
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics!
New in Observability Cloud - Explicit Bucket Histograms
