...oldtofrozendir = $SPLUNK_DB/defaultdb/frozendb frozentimeperiodinsecs = 1209600
According to the "Setaretirementandarchivingpolicy" and "indexes.conf" documentation on splunk docs, the settings i...
Hi,
I'm trying to delete old data due to space issue and I found this http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy.
But then I found that I have 4...
...o convert the days to minutes value and then use that in abucket configuration. But I didn't find any proper example in Splunk.
Can anyone help me on this or any good documentation with a proper e...
I wanted to know if I am getting the data from some stream say TCP stream, where is the data stored? As I understand the data gets uploaded and indexed but some day can I get that data from Splunk? o...
Where and how can I set the data retention on Splunk?
Because I have seen there are many bow to set it like telemetry, main etc..
So it's really not clear...
Hi,
When the maxVolumeDataSizeMB for the primary volume is exceeded, will the events automatically roll over to the secondary volume?
Here are my settings:
[volume:primary]
path = /a...
...ommand line :
./splunk clean eventdata -f
and I have tried to erase all my log from the splunk folder, but I have still the same problem.
Please can someone help me?
I am currently running a search for license bandwidth :
index=_internal source=*metrics.log group=per_index_thruput series!=_* | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB)
I...