Why is frozenTimePeriodInSecs 188697600 ?

[sunrise]

Hi Splunkers,

Just my interest, not a serious question.
Why is frozenTimePeriodInSecs about 6 years (188697600 secs =2184 days =5.9835 years),
not just 6 years ?

Thanks.

[yannK · Accepted solution]

yes, its about 6 time 364, maybe an approximation for the leap-years.
You can redefine a new default in /local/indexes.conf if you need.

[mlhadmin]

I don't see how leap years could have anything to do with it. A leap year has 1 more day than a regular year, so that doesn't explain why they would use 1 less day than a regular year...

[PickleRick]

A golden shovel award goes to you, sir/madam. 🙂

This is a thread from 11 years ago.

And the answer to the original question is probably "someone made a typo and mistakenly multiplied by 364 instead of 365".

[mlhadmin]

It looks like this mystery has not been solved within those 11 years though!

If your guess is correct, I guess they hadn't implemented Pull Requests yet whenever that code was added... 😜

I went looking for this answer, though, because in Splunk Cloud the _audit index is set to this default value for retention, and you are unable to change the retention setting for internal indexes in Splunk Cloud, so if you have a requirement to retain audit logs for 6 years, you're technically short by 6 days!

[PickleRick]

You can raise a case with Cloud support.