Getting Data In

Why am I still seeing data older than my frozenTimePeriodInSecs retention setting?

neelamsantosh
Path Finder

I have set the values to
maxDataSize = 1024
maxHotIdleSecs = 86400
maxWarmDBCount = 30
frozenTimePeriodInSecs = 6480000

But still i am seeing the older than 6480000 (75days) logs.

0 Karma

somesoni2
Revered Legend

A bucket will only be frozen if the youngest/earliest event in the bucket exceeds time period set on frozenTimePeriodInSecs. So there could be buckets with most of their events past 75days but not all so it will still be in the cold db (searchable).

0 Karma

ryanoconnor
Builder

It's possible some data in a bucket isn't older than 75 days. All data in a Data Bucket must be older than the frozenTimePeriodInSecs before it will roll.

Source: http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Indexesconf

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...