Hi @jamesvz84
I think you're looking for the frozenTimePeriodInSecs
configuration. Here's the relevant documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy#Set_attri...
It's possible, but not from the GUI. You need to edit your indexes.conf (likely at either $SPLUNK_HOME/etc/system/local/indexes.conf -- or $SPLUNK_HOME/etc/apps/search/local/indexes.conf) and add the following to whichever index stanza you want to change:
frozenTimePeriodInSecs = 15778463
Then, restart the indexer for the change to take effect.
For more information, refer to: http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Indexesconf
Hi @jamesvz84
I think you're looking for the frozenTimePeriodInSecs
configuration. Here's the relevant documentation:
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Setaretirementandarchivingpolicy#Set_attri...
Just adding extra info, the default configuration is frozenTimePeriodInSecs=188697600
which is 6 years before data gets rolled to frozen, but the link provided actually uses 180 days (or 15552000 seconds) in the example which is approximately 6 months.