ignore old logs control from indexer cluster

[sramiz]

Hello,

We are running 3 SH and 3 indexers cluster.  wondering how can we restrict indexers to ignore logs older than 30 days? I understand that it can be managed on UF inputs.conf by using ignoreOlderThan but is there a way to control this from indexers cluster level settings?

Note: sorry for a basic question but I am a beginner in splunking

thanks

SR

[scelikok]

Hi, @sramiz,

You can achieve this by index retention setting to 30 days.

[index_name]
frozenTimePeriodInSecs = 2592000

If this reply helps you, an upvote is appreciated.

[sramiz]

hi @scelikok Thanks for your reply but its not about deleting index or retention period. I want to know if there is a way for UF to ignore any logs that are older than 30 days and if this setting can in place from indexer cluster not in UF's inputs.conf.

thanks again