Splunk Enterprise

set frozentimeperiodinsecs in a legacy index

santos2020
Observer

Hi everyone.

We have a single Splunk entreprise instance.

We are planning to set frozentimeperiodinsecs in a legacy index that has not been used any more.

For example, I have the setup below.

namesizeevent countoldest datanewest data
indexA420GB3.06B6 years ago3 months ago
indexB370GB1.22B7 months agofew seconds ago
main270GBabove 200M6 years ago3 months ago

 

We are indexing data on IndexB now and are not using indexA & main any more, so we are planning to shrink its size to maintain disk space.

We don't want to delete it at once since we have compliance requirements and have to keep data for one year.

My question is, if I set frozentimeperiodinsecs(in local indexs.conf 's indexA, main stanza) to 1 year(31536000) on, when Splunk manages to delete it?

Do I have to reboot Splunk? or delete it with search commands manually?

someone please help me.

Labels (1)
Tags (1)
0 Karma

soutamo
SplunkTrust
SplunkTrust

After you have change that value to indexes.conf splunk start to check if there are buckets which all events are older than this value. If there are then it deletes (move to frozen) them. After that it does it periodically. If you are doing this with GUI splunk manages reboot if needed. If you are directly editing this on FS on individual system then you must reboot or refresh manually.

r. Ismo

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!