Use _indextime for data retention policy?

[jinxkamada]

Is it possible to reconfigure Splunk to use _indextime instead of _time for data retention policy?

[richgalloway]

That is not possible.

What problem are you trying to solve?

[jinxkamada]

I am regularly uploading a file over Splunk which I use for my reporting (might include events with various timestamp). 

I don't want data retention policy to be bounded by _time since it might affect the report I am creating. 
I definitely want Splunk to delete older uploads based on indexed time to manage my server disk usage.

Any suggestion will be appreciated!

[PickleRick · Accepted solution]

Can't you use time of ingestion as _time (which would influence retention) and use another field for storing your event's time (in this case it could make sense to make it an indexed field).

Buckets are rolled based on either age of data within the bucket (in terms of _time) or index size. That's it.

[isoutamo]

Or is there a possibility to use separate index for those events and afterwards even swipe out that content?

Anyhow as @PickleRick said a bucket is removed after all events inside it has expired. Using old and new data (timestamp/_time point of view) usually make this to take quite long time.

[jinxkamada]

Most of the indexes we have right now are used for the same purpose of creating a report.

It would have been ideal for me if they can use the Search menu (out-of-the-box UI) so it would save me the hassle of creating a custom UI to point datetime filtering to the correct field.

However, I would say your recommendations do make sense.
Thanks for the inputs!