Knowledge Management

data retention for an index how to control archiving policy

splunkjpm
Loves-to-Learn Lots

We have several indexes where we have set the maxTotalDataSIzeMB to a specific value is it also possible to configure the frozenTimePeriodInSecs for the same indexes. Can you have both paramters configured for the same index and if so which one takes priority in determining when to delete data is it the size of index or age of the date. For our purpose we are first looking for data to roll off if it exceed 30 days old and as a second check if data is less than 30 days old but index size is greater than 10 GB dta should roll off

0 Karma

lukejadamec
Super Champion

Both of these are independent, so either one can trigger a roll.

For the frozenTime setting all events in the db must be older than the setting for the db to roll to frozen, so if the db has many days worth of data you can have more than 30 days stored in the index.

For the size setting, when the index reaches the max size the oldest db will roll.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...