Getting Data In

maxTotalDataSizeMB max value or 0


Can you set maxTotalDataSizeMB to 0, or optionally set it to an incredibly high number (90000000, or 90TB) in order to hopefully make the cold-to-frozen process only happen based on frozenTimePeriodInSecs. Basically time based retention instead of the maxTotalDataSizeMB?



might be Splunk will auto-tune itself to go with the highest priority fields ?! not sure...
But, i hope that Splunk wont delete the data , it makes the index size to grow till max size


0 Karma

Splunk Employee
Splunk Employee

Per the docs for indexes.conf, the maximum value is 4294967295 MB. Setting it that high would result in time-only retention.

0 Karma