Splunk Search

Retention Policy - Keep only 3 months of data

qiaojing
Path Finder

Hi, may i know how to configure Splunk to only retain a rolling window of 3 months of logs data?

I'm completely new to the retention policy so any help or step by step instruction will be greatly appreciated.

Thank you.

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

If you want to remove data completely from the system after 3 months, then you might need to set frozenTimePeriodInSecs=7776000 in indexes.conf

Please refer below for detailed information

https://wiki.splunk.com/Deploy:BucketRotationAndRetention
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

If you want to remove data completely from the system after 3 months, then you might need to set frozenTimePeriodInSecs=7776000 in indexes.conf

Please refer below for detailed information

https://wiki.splunk.com/Deploy:BucketRotationAndRetention
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!