Knowledge Management

Creating an index: New Index Max Size vs Retention

aohls
Contributor

I am looking to setup a new summary index. When creating the index how does Max Size of Entire Index and Retention interact with one another. Would data get removed once one of these settings are hit? For example if I have 5GB and set the retention to 30 days, if I exceed 5GB at 20 days will it truncate the oldest days at that time; and the same if I set the retention to 30 days but only have 2GB out of 5 used, will it start truncating the old data?

0 Karma
1 Solution

Mayurmpatil
Path Finder

If maxTotalDataSizeMB(index size) is reached before frozenTimePeriodInSecs(retention period), data will be rolled to frozen before the configured time period has elapsed. If archiving has not been configured, unintended data loss can occur.

also if frozenTimePeriodInSecs(retention period) is reached before the index size of 5 gb is not reached , data will be rolled to frozen.

so in theory whatever reaches first will be applicable.

View solution in original post

Mayurmpatil
Path Finder

If maxTotalDataSizeMB(index size) is reached before frozenTimePeriodInSecs(retention period), data will be rolled to frozen before the configured time period has elapsed. If archiving has not been configured, unintended data loss can occur.

also if frozenTimePeriodInSecs(retention period) is reached before the index size of 5 gb is not reached , data will be rolled to frozen.

so in theory whatever reaches first will be applicable.

aohls
Contributor

@Mayurmpatil Thank you. We are just starting to use the summary index so this is helpful.

Mayurmpatil
Path Finder

@aohls - can you up vote my answer if you have happy with it.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...