increase logs indexing time

[aalaa]

i want to increase the log indexing time, for the moment the log are only accessible two days on my indexer and search head, how can i increase the time for the logs to go accessible for two months ? Any help please !
thank you

[tiagofbmm · Accepted solution]

I think you're trying to say you want the logs to stay available for 2 months (retention period). The field _indextime is not changeable.

You can change in indexes.conf the maxTotalDataSizeMB and frozenTimePeriodInSecs attributes. They help determine when buckets roll from cold to frozen.

If you didn't change the default configuration, frozen means the logs are removed from Splunk. So basically if you want your logs to reside for longer, increase the frozenTimePeriodInSecs:

[<indexname>]
frozenTimePeriodInSecs =

https://docs.splunk.com/Documentation/Splunk/7.3.0/Indexer/Setaretirementandarchivingpolicy

[aalaa]

Thank you !
index.conf under the Search head or the indexer ?
what is the value to add in frozenTimePeriodInSecs for two months ?

[tiagofbmm]

In the indexer indexes.conf of the Indexer only

If you want 2 months then convert it to seconds: 60*86400=5184000

[]
frozenTimePeriodInSecs =

[aalaa]

thank you 🙂

[tiagofbmm]

welcome. don't forget to upvote the accepted answer 😉