create index that keeps data by date, not size?

[seanlon11]

I have many indexes in my environment, which all have a maximum size set. However, we would like to instead keep data in an index according to date. For example: we want to keep all data in an index that is less than 30 days old.

Is this possible?

Thanks,
Sean

[seanlon11 · Accepted solution]

After using some different search times, I have found how to do this by using the frozenTimePeriodInSecs attribute for an index when setting it up in the indexes.conf file.

http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy#Freeze_data...

Simple now that I found it, but maybe this helps someone else out there.