Knowledge Management

Creating an index: New Index Max Size vs Retention

aohls
Contributor

I am looking to setup a new summary index. When creating the index how does Max Size of Entire Index and Retention interact with one another. Would data get removed once one of these settings are hit? For example if I have 5GB and set the retention to 30 days, if I exceed 5GB at 20 days will it truncate the oldest days at that time; and the same if I set the retention to 30 days but only have 2GB out of 5 used, will it start truncating the old data?

0 Karma
1 Solution

Mayurmpatil
Path Finder

If maxTotalDataSizeMB(index size) is reached before frozenTimePeriodInSecs(retention period), data will be rolled to frozen before the configured time period has elapsed. If archiving has not been configured, unintended data loss can occur.

also if frozenTimePeriodInSecs(retention period) is reached before the index size of 5 gb is not reached , data will be rolled to frozen.

so in theory whatever reaches first will be applicable.

View solution in original post

Mayurmpatil
Path Finder

If maxTotalDataSizeMB(index size) is reached before frozenTimePeriodInSecs(retention period), data will be rolled to frozen before the configured time period has elapsed. If archiving has not been configured, unintended data loss can occur.

also if frozenTimePeriodInSecs(retention period) is reached before the index size of 5 gb is not reached , data will be rolled to frozen.

so in theory whatever reaches first will be applicable.

aohls
Contributor

@Mayurmpatil Thank you. We are just starting to use the summary index so this is helpful.

Mayurmpatil
Path Finder

@aohls - can you up vote my answer if you have happy with it.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...