Which takes precedence - frozenTimePeriodInSeconds...

a212830 · ‎08-25-2014

Hi,

Which takes precedence in indexes.conf - frozenTimePeriodInSeconds or maxTotalDataSizeMB? Also, if I set maxTotalDataSizeMB to zero, will that make it unlimited?

Lucas_K · ‎08-25-2014

I would have thought its the first one to be hit. I don't think there is any precedence as such as they both perform similar actions (roll to frozen).

"Also, if I set maxTotalDataSizeMB to zero, will that make it unlimited?" Nope.

"Highest legal value is 4294967295" ~ 4.294 petabytes. - http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Indexesconf

Which takes precedence - frozenTimePeriodInSeconds or maxTotalDataSizeMB

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Join the Conversation