Which takes precedence - frozenTimePeriodInSeconds...

a212830 · ‎08-25-2014

Hi,

Which takes precedence in indexes.conf - frozenTimePeriodInSeconds or maxTotalDataSizeMB? Also, if I set maxTotalDataSizeMB to zero, will that make it unlimited?

Lucas_K · ‎08-25-2014

I would have thought its the first one to be hit. I don't think there is any precedence as such as they both perform similar actions (roll to frozen).

"Also, if I set maxTotalDataSizeMB to zero, will that make it unlimited?" Nope.

"Highest legal value is 4294967295" ~ 4.294 petabytes. - http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Indexesconf

Which takes precedence - frozenTimePeriodInSeconds or maxTotalDataSizeMB

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation