Getting Data In

create index that keeps data by date, not size?

seanlon11
Path Finder

I have many indexes in my environment, which all have a maximum size set. However, we would like to instead keep data in an index according to date. For example: we want to keep all data in an index that is less than 30 days old.

Is this possible?

Thanks,
Sean

Tags (3)
1 Solution

seanlon11
Path Finder

After using some different search times, I have found how to do this by using the frozenTimePeriodInSecs attribute for an index when setting it up in the indexes.conf file.

http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy#Freeze_data...

Simple now that I found it, but maybe this helps someone else out there.

View solution in original post

seanlon11
Path Finder

After using some different search times, I have found how to do this by using the frozenTimePeriodInSecs attribute for an index when setting it up in the indexes.conf file.

http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/Setaretirementandarchivingpolicy#Freeze_data...

Simple now that I found it, but maybe this helps someone else out there.

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...