Why frozenTimePeriodInSecs does not take effect?

[Gabriel]

Hi everyone

I got a question on the frozenTimePeriodInSecs parameter. Here are my settings inside the indexes.conf file:

/opt/splunk/etc/system/local/indexes.conf

[_internal]
frozenTimePeriodInSecs = 864000 # Data retention set to 10 days.
maxTotalDataSizeMB = 750

[_audit]
frozenTimePeriodInSecs = 864000 # Data retention set to 10 days.
maxTotalDataSizeMB = 750

What I would expect is, that buckets in _internal and _audit where all events are older than 10 days get deleted. However, this is not the case. Anyone knows why? On the other hand, maxTotalDataSizeMB does work as expected.

I have checked a couple places for hints why frozenTimePeriodInSecs does not work. The results of those checks are further down below as screenshots.

- buckets: Whether there are buckets that contain only events older than 10 days.
- btools: Whether the settings are actually taken into account.
- monitoring console: Whether the settings are actually taken into account.
- _internal logs: Check whether there are freeze events occuring. They only appear for maxTotalDataSizeMB.

_audit Buckets_audit btool outputmonitoring console 1monitoring console 2freeze events

[PickleRick]

Normally it _should_ work.

The question is how you configured those retention parameters - webui/files/rest? If you did it with conf files, did you reload the daemon? While btool shows the contents of files on disk, you might want to check the runtime config from splunkd memory

splunk show config indexes

and check if it's the same as what btool reports.

[Gabriel]

Hi Rick 😃

I edited the indexes.conf file by hand on the server, then restarted splunk. Running the command you suggested also shows that frozenTimePeriodInSecs is equivalent to what btool reports and is active in the runtime:

runtime config