frozenTimePeriodInSecs and coldToFrozenScript

[DazzedNConfused]

frozenTimePeriodInSecs….if you set this to seconds and set a frozen path….is this enough to freeze data? Do I always need to specify a cold to frozen script? What if I just want Splunk to do this automatically?

[somesoni2 · Accepted solution]

To implement the data retention policy, you would need to set minimum of frozenTimePeridInSecs needs to be set. By default the frozen buckets will be deleted. If you want to archive the frozen bucket then any one of coldToFrozenScript OR coldToFrozenDir needs to be specified. If both coldToFrozenDir and coldToFrozenScript are specified, coldToFrozenDir will take precedence.

See more information here. http://docs.splunk.com/Documentation/Splunk/6.2.5/Admin/indexesconf

There are other parameters that may needs to be set (based on your environment), see more details here
http://wiki.splunk.com/Deploy:BucketRotationAndRetention