How to Change Splunk frozenTimePeriodInSecs for any of the indexes

[CHAUHAN812]

I want to increase one of my index frozen Time Period from 12 months to 13 months. I have increased the Max Size of Entire Index from the Splunk indexer > Settings. But I know this is not enough as my index frozen Time Period is set on 12 months period.

So where should I update this value ?

Should I need to update 'Indexes.conf' file for required indexes to the indexer server itself which is installed on Linux machine.

What things I need to take care while updating this frozen Time Period.

[CHAUHAN812]

Thank you for your quick responses. I have increased the frozen time period from my indexer machine. And I am able to increase it according to my requirement.

[isoutamo]

If you have individual indexers then it is correct place. After change do reload for it. If you have indexer cluster then you must do this change on CM. Edit correct indexes.conf file somewhere under master-apps or manager-apps. After that apply cluster-bundle, when it has distributed into search peers.

[CHAUHAN812]

Yes , I have an individual indexer which is installed on Linux machine. And I need to increase the frozenTimePeriodInSecs only for 2 of the indexes.

So to increase the Frozen Time Period from 12 months to 13 months then I just need to update the frozenTimePeriodInSecs values to the indexes.conf file from the indexer server right ?

[luizlimapg · Accepted solution]

Hi @CHAUHAN812,

In that case, in the indexes.conf file, you just need to adjust the frozenTimePeriodInSecs parameter in the 2 index stanzas.

[index01]
frozenTimePeriodInSecs = 34187400

[index02]
frozenTimePeriodInSecs = 34187400

Restart Splunk after that

[CHAUHAN812]

Thanks,

So this should be done in the indexer server right ?

[isoutamo]

Here is link to docs https://docs.splunk.com/Documentation/Splunk/9.4.0/Indexer/Setupmultipleindexes
Remember if you are editing conf files then you must do restart or in some cases reload is enough. If you want to avoid that, then you should use GUI or CLI commands to modify those values.

[PickleRick]

Or REST.

[luizlimapg]

Right! If you have only one indexer