Splunk log retention

[BRFZ]

Hello,

I would like to know if it possible to define the retention period for each type of log (Hot/Warm/Cold). For example, setting the total frozenTimePeriodInSecs to 3 years while specifying a 1 year retention period for each stage (Hot,Warm and Cold). Could you please clarify this?

[PickleRick]

The short answer is - no.

The long answer is - at each stage of bucket's lifecycle (hot/warm/cold) it's limited by different set of parameters. See https://conf.splunk.com/files/2017/slides/splunk-data-life-cycle-determining-when-and-where-to-roll-...

Addifional size constraints can be added on a per-volume level.