data retention of sourcetype

[trojan_81]

Two questions regarding Dynamic Data Storage:

1) Within an Index, can I archive a specific sourcetype only or can I only archive the entire index?

2) Let's say Index main has searchable time of 365 days.  I select dynamic data storage < Splunk Archive <  and specify Archive Retention Period of 365 days. 

Does that mean when original event data reaches 365 days, it will move to splunk storage as Frozen and be available for another 365 days?  Why is there no option to define max size? 

[gcusello]

Hi @trojan_81,

about your questions, I think that you should read at https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Howindexingworks

Anyway, Splunk data are archived in buckets and archiving is managed at bucket level, in other words, Splunk archives a buckets, according with the configured policies when it reaches one of the following conditions:

• the index dimensions exceeds the maxTotalDataSizeMB value: in this case the oldest bucket is discarded or managed following the archiving policy you configured (e.g. copy on anothe folder);
• the newest event of a bucket exceeds the retention time: in this case the bucket is discarded or managed following the archiving policy you configured (e.g. copy on anothe folder).

So answering to your questions:

1. you cannot archive a specific sourcetype and usually you don't need to archive the entire index, you archive buckets;
2. main index retention time and dimensions can be managed like all the other indexes, so you can change retention time and dimension of this index changing maxTotalDataSizeMB and/or frozenTimePeriodInSecs in $SPLUNK_HOME/system/local/indexes.conf, if you haven't create it from default folder.
3. there are many parameters to define max size e.g. maxTotalDataSizeMB , for more infos, see at https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Indexesconf

Ciao.

Giuseppe