maxTotalDataSizeMB max value or 0

[adamw]

Can you set maxTotalDataSizeMB to 0, or optionally set it to an incredibly high number (90000000, or 90TB) in order to hopefully make the cold-to-frozen process only happen based on frozenTimePeriodInSecs. Basically time based retention instead of the maxTotalDataSizeMB?

Thanks,
--adam

[chimbudp]

might be Splunk will auto-tune itself to go with the highest priority fields ?! not sure...
But, i hope that Splunk wont delete the data , it makes the index size to grow till max size

maxTotalDataSizeMB
frozenTimePeriodInSecs

[sowings]

Per the docs for indexes.conf, the maximum value is 4294967295 MB. Setting it that high would result in time-only retention.