what are the files need to be deleted under splogs ?

[Kaushikkatta03]

our indexers are completely filled
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_hsplunkp03_san-splunk_logs
5.6T 5.2T 115G 98% /splogs

What are the files to be deleted or to reduce the size

[sjohnson_splunk · Accepted solution]

The default retention time (except for _internal) is 6 years. You need to decide which indexes you need to keep and then set this in indexes.conf:

frozenTimePeriodInSecs =
* Number of seconds after which indexed data rolls to frozen.
* If you do not specify a coldToFrozenScript, data is deleted when rolled to
frozen.
* IMPORTANT: Every event in the DB must be older than frozenTimePeriodInSecs
before it will roll. Then, the DB will be frozen the next time splunkd
checks (based on rotatePeriodInSecs attribute).
* Highest legal value is 4294967295
* Defaults to 188697600 (6 years).

You can set this for each index or set it under the [default] stanza to have it apply to all indexes.

[somesoni2]

What you need to do is to setup data retention policies on your data, so that undesired data is not kept on indexer and saved disk. See this for more details.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Setaretirementandarchivingpolicy

[Kaushikkatta03]

Hello ,

We have the configuration set up to default , as the logs are in cold state so can we delete this old logs which are 3 years old .