Getting Data In

Data Archiving and Retirement

zachantinelling
Explorer

I am trying to configure a new instance of splunk, my requirements for data retention are:

Searchable 14 days
Archive 5 years

I have configured the indexes.conf as below for my index:

coldtofrozendir = $SPLUNK_DB/defaultdb/frozendb
frozentimeperiodinsecs = 1209600

According to the "Set a retirement and archiving policy" and "indexes.conf" documentation on splunk docs, the settings i've configured should roll the buckets to my frozen directory when the events are two weeks old and leave them there for me to handle.

However - myself and the sales engineer are stumped as to why the events in the hot bucket are still over 3 months old. Have we read the documentation correctly? Your input is greatly appreciated.

Thank you!

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your hot buckets are not rolling, probably because they're not filling up. Try setting maxHotSpanSecs=86400 to force them to roll to warm after a day.

---
If this reply helps you, Karma would be appreciated.

zachantinelling
Explorer

Thanks for your reply Rich. Looks like this worked and it is now rolling the data to my frozen bucket. I have also set frozentimeperiodinsecs = 1209600 but yet the data in my hot/warm bucket is still aged as far back as 7 months and I don't have any data being rolled into the cold buckets. Any idea why this would be happening?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

No. Sorry.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...