How to clean index data after every one week?

[Ashwini008]

Hi, 

How can i delete the data in index after every one week? I came across Splunk answers and documents it is mentioned that we cannot completey clear index data as it depends on two attributes maxTotalDataSizeMB and frozenTimePeriodInSecs . I am confused 😕

So i am using this index data in dashboard and basically i don't want to show the old data(P.s dealing with millions of user data so sorting/deduping is not an option).Now every week new data comes to the index so when it happens i have to clear the old data existing in my index .

Irrespective of whether index has reached max default size or Frozen time period or maxHotSpanSecs  has reached its value how can i set the attributes in the index so that index data is empty every week?

Thanks!

[PickleRick]

You're mixing two different things.

One is the actual data retention - how long you keep the data in the index in case you want to search it later. And here indeed those two parameters are responsible for when splunk choses to "evict" old data and remove a bucket (remember that splunk doesn't expire single events but whole buckets).

Another thing is timerange of your search. You set it either using timepicker or specifying "earliest" and "latest" parameters. You can also limit your users to some subset of data available if you don't want some of them to peek too far into the past (but I don't remember if you can set it per index or only globally for user).

[ITWhisperer]

Set the time frame on your search so that it starts at the beginning of the week

... earliest=@w