Knowledge Management

Creating an index: New Index Max Size vs Retention

aohls
Contributor

I am looking to setup a new summary index. When creating the index how does Max Size of Entire Index and Retention interact with one another. Would data get removed once one of these settings are hit? For example if I have 5GB and set the retention to 30 days, if I exceed 5GB at 20 days will it truncate the oldest days at that time; and the same if I set the retention to 30 days but only have 2GB out of 5 used, will it start truncating the old data?

0 Karma
1 Solution

Mayurmpatil
Path Finder

If maxTotalDataSizeMB(index size) is reached before frozenTimePeriodInSecs(retention period), data will be rolled to frozen before the configured time period has elapsed. If archiving has not been configured, unintended data loss can occur.

also if frozenTimePeriodInSecs(retention period) is reached before the index size of 5 gb is not reached , data will be rolled to frozen.

so in theory whatever reaches first will be applicable.

View solution in original post

Mayurmpatil
Path Finder

If maxTotalDataSizeMB(index size) is reached before frozenTimePeriodInSecs(retention period), data will be rolled to frozen before the configured time period has elapsed. If archiving has not been configured, unintended data loss can occur.

also if frozenTimePeriodInSecs(retention period) is reached before the index size of 5 gb is not reached , data will be rolled to frozen.

so in theory whatever reaches first will be applicable.

aohls
Contributor

@Mayurmpatil Thank you. We are just starting to use the summary index so this is helpful.

Mayurmpatil
Path Finder

@aohls - can you up vote my answer if you have happy with it.

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...