Why is Splunk not retaining logs beyond 90 days?

[SinghK]

hi All,

Though i have set frozenTimePeriodInSecs to a year on a cluster, the logs are only getting retained till 90 days max

same settings in other cluster is working fine. need some help checking the issue.

thanks in advance,

[PickleRick · Accepted solution]

First thing to check - size limit. The buckets are getting frozen when either

1) The earliest event in the bucket is oldest than the bucket age limit or

2) The data reaches maxTotalDataSizeMB limit

So even if your data is not old enough but you have enough  data to fill your index to the limit, your oldest buckets will get frozen/discarded.

[SinghK]

In my case it was maxvolumedatasizemb

[SinghK]

thanks @PickleRick , I will check that ..