Thank you for your replay. Just to clarify here is an example from indexes.conf from master server with frozenTimePeriodinSec at the bottom:  [demisto_poc] homePath = volume:ssd/demisto_poc/db coldPath = volume:sas/demisto_poc/colddb thawedPath = /splunk_thawed_data/demisto_poc/thaweddb homePath.maxDataSizeMB = 1000 maxTotalDataSizeMB = 10000 repFactor = auto frozenTimePeriodInSecs = 48384000   Could you tell me if there is no correlation between those settings that might cause the issue?  I deployed this change two days ago and till today there is no effect when I check the oldest log available on the search heads. Thanks  ... View more

Thanks for clarifying this. I have made a change to the file indexes.conf in the directory /opt/splunk/etc/master-apps/sky_cluster_indexer_base/local on the master server and then I have applied the cluster change with a command: /opt/splunk/bin/splunk apply cluster-bundle however there is no affect on search head servers. Should I restart them to start deleting the old logs (5 years)?  ... View more

We have logs from firewalls and web applications. What I need is to extract field names that are used by our alerts (queries) to compare the, with the fields used by a different team and tools. ... View more