Index Retention

[nawazns5038]

Hi,

If I just mention frozenTimePeriodInSecs as 30 days , how does Splunk roll the buckets exactly so that the data gets deleted in 30 days ?

Will adding the parameters like homePath.maxDataSizeMB , coldPath.maxDataSizeMB effect the rolling of buckets ?

[richgalloway]

Retention time refers to the newest event in a bucket. If a bucket typically holds 7 days of data, for example, then it will not be deleted until it is 37 days old because the last event written to it must be at least 30 days old.

The size constraints are considered separately. If an index reaches its size limit, the oldest buckets will be deleted until the index is within the size limit. This means buckets may be frozen before 30 days.

[nawazns5038]

Thanks for the answer @richgalloway,

But the parameter frozenTimePeriodInSecs applies to cold buckets , there are bucket stages in between. How does Splunk organize the rolling so that data falls into the cold and retention is applied

What if the data volume is low and is present only in the hot and warm buckets itself and didn't come into cold still and the period has exceeded 30 days ?
So the retention policy will not apply in this case ??

[ddrillic]

frozenTimePeriodInSecs is actually the time from creation to frozen, regardless of the stages in between.