Splunk Search

Does frozenTimePeriodInSecs work in [default]?

wsanderstii
Path Finder

I have a local indexes.conf file on all my indexers:
[default]
frozenTimePeriodInSecs = 63072000 # 2 yr
[main]
frozenTimePeriodInSecs = 15552000 # 180d

This seems to have worked on main but not on any other indexes. Does frozenTimePeriodInSecs work in [default]? Or do I have to enter a value for each index? Or should I put the value outside a stanza?

wsanderstii
Path Finder

Actually what worked was putting "frozenTimePeriodInSecs = 63072000" (2 years) outside of any stanza in /opt/splunk/etc/master-apps/_cluster/local/indexes.conf.

Thanks for the replies.

0 Karma

mayurr98
Super Champion

The information you see under [default] is a global setting that take precedence if you haven't defined a setting for a specific index. These settings come from /etc/system/default/indexes.conf. This can be a bit confusing as if you look into indexes.conf, global settings do not exist within a [default] stanza. Additionally, there is no need to create a [default] stanza.

If you take a look at the settings in $SPLUNK_HOME/etc/system/default/indexes.conf, you'll notice the settings for frozenTimePeriodInSecs matches the setting under this section:

<code># index specific defaults
frozenTimePeriodInSecs = 188697600
</code>

Since this setting also exists for [main], per the btool ouput, the setting for main takes precedence. This is part of the reason that btool is a technical support utility. The output can be confusing if you aren't sure what to expect. In this instance, since btool does show main as having the value defined, you can be sure that this is what will take effect. If you wanted to ensure all indexes had this behavior by default, you could copy the global settings from $SPLUNK_HOME/etc/system/default/indexes.conf into $SPLUNK_HOME/etc/system/local/indexes.conf.

Also,
You set it in local/indexes.conf on an index per index basis.
And yes you can do it exactly as you state.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy

[your_custom_index]
 frozenTimePeriodInSecs = <retention_period>

let me know if this helps!

somesoni2
Revered Legend

The attribute frozenTimePeriodInSecs is per index option, so it should be specified in the stanza for each index. Without specifying it, default value of it would be 6 years or 188697600.

When you specify it in [default] section, it's getting applied to default index which is main (as specified in attribute defaultDatabase)

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...