I have a Splunk cluster with 5 indexers, 1 cluster master and 1 search head. All 5 indexer got the same indexes.conf distributed by cluster master with the same frozenTimePeriodInSecs=2592000 but the search head is not configured via cluster bundle so it ended up having default value which is 188697600. Will that value affect the retention policy which is expected to be 30 days (2592000 sec) or only indexers' frozenTimePeriodInSecs is considered by Splunk when it decided which bucket needs to be freeze.
$ /opt/splunk/bin/splunk search "| rest /services/data/indexes | search title=main |fields title,frozenTimePeriodInSecs,splunk_server"
title frozenTimePeriodInSecs splunk_server
----- ---------------------- -------------
main 188697600 search-head
main 2592000 indexer01
main 2592000 indexer02
main 2592000 indexer03
main 2592000 indexer04
main 2592000 indexer05
Thank you,
Max
... View more