Trim an index down to 90 days and recover space

[beaunewcomb]

So say I have an index that's got data in it back 120 Days, and I want to delete events older than 90 days, keeping the indexes trimmed to 90 days going forward. Would the below process accomplish this?

Set indexes.conf:

[indexname]
frozenTimePeriodInSecs = 7776000

restart splunk

I'm assuming that if I restart splunk, it will automatically go through and start deleting stuff older than 90 days on its own. Is this correct?

[emiller42 · Accepted solution]

One thing to keep in mind is that a bucket won't transition over to frozen until ALL events in the bucket exceed the timeframe given. On low volume indexes, it's possible for a bucket to have data from a wider date range, and thus would hang around longer than expected.

Another way to approach this is to estimate how much data you index in the time period desired, and then set the maxTotalDataSizeMB accordingly.

[emiller42]

You can, and both will apply. So it will freeze buckets that go past the expiration time, or when the total index exceeds the size parameter. Whichever comes first.

[beaunewcomb]

Can you set both the max size and time?

[kristian_kolb]

Yes that's right. Be VERY careful with that. Getting a few numbers wrong could let you lose a LOT of data fast 😉

[chris]

Yes 🙂 At least thats the what happened on the index I just tried this.