Can we set frozentimePeriodInSecs on a per sourcetype basis?

[srinivasup]

Hi Team,

Is there a way to set frozenTimePeriodInSecs value per sourcetype?
I have the same sourcetype used for multiple sources. Based on our client's requirement, we need to make changes to frozenTimeperiodInSecns based on sourcetype.

Is there a way to make this change?

Thanks

[acharlieh]

frozenTimePeriodinSecs is an indexes.conf configuration. If you need to adjust it per sourcetype, then you need to send the different sourcetypes to different indexes. You could potentially dynamically route the sourcetypes to different indexes as well... See http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/Setupmultipleindexes for more info on multiple indexes and this kind of routing.