Hi I have Firepower . and sends my logs with estreamer to Splunk. my problem : Splunk keeps logs for 70 days, and before 70 days I don't have any logs on Splunk. How do I keep my logs for 1 year on Splunk? I read some notes about maxTotalDataSizeMB and frozenTimePeriodInSecs , that I must change the value in indexs.conf, but I dont know where I change them (GUI or CLI)? I have many indexes.conf file whenever I search for it. I changed maxTotalDataSizeMB value of 500gig to 800gig in index.conf in path opt/splunk/etc/system/local but I don't find any parameter of frozenTimePeriodInSecs in that. Whenever I use df -h command in cli, it shows, used 498gig of 840gig disk .and this parameter change between 488 and 498 gig .   Can anyone help me?   ... View more