Getting Data In

maxTotalDataSizeMB max value or 0

Communicator

Can you set maxTotalDataSizeMB to 0, or optionally set it to an incredibly high number (90000000, or 90TB) in order to hopefully make the cold-to-frozen process only happen based on frozenTimePeriodInSecs. Basically time based retention instead of the maxTotalDataSizeMB?

Thanks,
--adam

Contributor

might be Splunk will auto-tune itself to go with the highest priority fields ?! not sure...
But, i hope that Splunk wont delete the data , it makes the index size to grow till max size

maxTotalDataSizeMB
frozenTimePeriodInSecs

0 Karma

Splunk Employee
Splunk Employee

Per the docs for indexes.conf, the maximum value is 4294967295 MB. Setting it that high would result in time-only retention.

0 Karma