Splunk Enterprise

set frozentimeperiodinsecs in a legacy index

santos2020
Observer

Hi everyone.

We have a single Splunk entreprise instance.

We are planning to set frozentimeperiodinsecs in a legacy index that has not been used any more.

For example, I have the setup below.

namesizeevent countoldest datanewest data
indexA420GB3.06B6 years ago3 months ago
indexB370GB1.22B7 months agofew seconds ago
main270GBabove 200M6 years ago3 months ago

 

We are indexing data on IndexB now and are not using indexA & main any more, so we are planning to shrink its size to maintain disk space.

We don't want to delete it at once since we have compliance requirements and have to keep data for one year.

My question is, if I set frozentimeperiodinsecs(in local indexs.conf 's indexA, main stanza) to 1 year(31536000) on, when Splunk manages to delete it?

Do I have to reboot Splunk? or delete it with search commands manually?

someone please help me.

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

After you have change that value to indexes.conf splunk start to check if there are buckets which all events are older than this value. If there are then it deletes (move to frozen) them. After that it does it periodically. If you are doing this with GUI splunk manages reboot if needed. If you are directly editing this on FS on individual system then you must reboot or refresh manually.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...