How to automate deletion of log data from Splunk Indexer based on time of indexing

[sdhiren]

We are currently indexing big log files (~1 GB in size) in our Splunk indexer using Splunk Universal Forwarder.

All the logs data will be stored in a single index.

We want to make sure the logs data is deleted after one week from the date it was indexed. 

Is there a way to achieve the same?

[richgalloway]

Use the frozenTimePeriodInSecs setting in indexes.conf to control how long data lives in the index.

[myindex]
frozenTimePeriodInSecs = 604800