Splunk Search

Does frozenTimePeriodInSecs work in [default]?

Path Finder

I have a local indexes.conf file on all my indexers:
frozenTimePeriodInSecs = 63072000 # 2 yr
frozenTimePeriodInSecs = 15552000 # 180d

This seems to have worked on main but not on any other indexes. Does frozenTimePeriodInSecs work in [default]? Or do I have to enter a value for each index? Or should I put the value outside a stanza?

Path Finder

Actually what worked was putting "frozenTimePeriodInSecs = 63072000" (2 years) outside of any stanza in /opt/splunk/etc/master-apps/_cluster/local/indexes.conf.

Thanks for the replies.

0 Karma

Super Champion

The information you see under [default] is a global setting that take precedence if you haven't defined a setting for a specific index. These settings come from /etc/system/default/indexes.conf. This can be a bit confusing as if you look into indexes.conf, global settings do not exist within a [default] stanza. Additionally, there is no need to create a [default] stanza.

If you take a look at the settings in $SPLUNK_HOME/etc/system/default/indexes.conf, you'll notice the settings for frozenTimePeriodInSecs matches the setting under this section:

<code># index specific defaults
frozenTimePeriodInSecs = 188697600

Since this setting also exists for [main], per the btool ouput, the setting for main takes precedence. This is part of the reason that btool is a technical support utility. The output can be confusing if you aren't sure what to expect. In this instance, since btool does show main as having the value defined, you can be sure that this is what will take effect. If you wanted to ensure all indexes had this behavior by default, you could copy the global settings from $SPLUNK_HOME/etc/system/default/indexes.conf into $SPLUNK_HOME/etc/system/local/indexes.conf.

You set it in local/indexes.conf on an index per index basis.
And yes you can do it exactly as you state.


 frozenTimePeriodInSecs = <retention_period>

let me know if this helps!

Revered Legend

The attribute frozenTimePeriodInSecs is per index option, so it should be specified in the stanza for each index. Without specifying it, default value of it would be 6 years or 188697600.

When you specify it in [default] section, it's getting applied to default index which is main (as specified in attribute defaultDatabase)

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? &#x1f680; We invite you to join our elite squad ...