Increase Cold retention period

[saeed]

Hi,

I would like to increase the cold retention period for index [pa] to 180 days, but when i  get into indexes.conf i only see below configuration there is no frozenTimePeriodInSecs = for index pa

# Index for Palo Alto Networks
# This index is required by Splunk_TA_paloalto
[pa]
repFactor = auto
homePath   = volume:hot/pa/db
homePath.maxDataSizeMB = 512000
coldPath   = volume:cold/pa/colddb
coldPath.maxDataSizeMB = 512000
thawedPath = $SPLUNK_DB_THAWED/pa/thaweddb
coldToFrozenDir = $SPLUNK_DB_FROZEN/pa/frozendb

where can i find the time setting for this index?

[gcusello · Accepted solution]

Hi @saeed,

probably your index takes the retention period from the default value (6 years) or from another default definition.

Anyway,

you can add to your index definition also the option:

frozenTimePeriodInSecs = 180

 in this way you define the retention period for that index.

Ciao.

Giuseppe

[saeed]

Thanks a lot 

I will add it and it will be like this:

[pa]
repFactor = auto
homePath   = volume:hot/pa/db
homePath.maxDataSizeMB = 512000
coldPath   = volume:cold/pa/colddb
coldPath.maxDataSizeMB = 512000
thawedPath = $SPLUNK_DB_THAWED/pa/thaweddb
coldToFrozenDir = $SPLUNK_DB_FROZEN/pa/frozendb
frozenTimePeriodInSecs = 15552000

Correct? 

[gcusello]

Hi @saeed,

if this answer solves your problem, please accept it for the other people of Community.

Otherwise, please tell me what's you problem so I can help you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[saeed]

Thanks a lot @gcusello 

My problem is the current retention period is 52 days and i want to increase the cold storage for Palo Alto index to be searchable for the last 6 months , i only found time setting under [ default ]:

frozenTimePeriodInSecs = 4492800

 i didn't find time period for index [pa]

[gcusello]

Hi @saeed,

in this case, inserting  frozenTimePeriodInSecs in the "pa" index definition (in indexes.conf) you override the default value and you give the value you want only to this index.

Ciao and happy splunking.

Giuseppe