Getting Data In

Delete index foobar info older than 2 weeks.

Splunk Employee
Splunk Employee

we only want to save the log info for 2 weeks. I tried to set this up by modifying the frozen time, but it doesn’t seem to work. How can I delete info from index foobar database that is older than 2 weeks?

Tags (1)

Splunk Employee
Splunk Employee

frozenTimePeriodInSecs does not guarantee deletion after that time. It simply means that data may be deleted after that time. Data older than that will in fact be deleted as long as everything else that it shares an index bucket with is also eligible for deletion. This is because deletion (by which I mean actual deletion not the surgical | delete command - that doesn't really "delete" data) is done on a whole-bucket basis, so unless an entire bucket is eligible for deletion, none of the data will be deleted.

Super Champion

Off the top of my head, you will probably need to make sure that your buckets are rotated quite frequently, which can be done by setting a very low maximum hot size or setting a short max time span, or both, I suppose.



# 2 day max for hot

# 200 Mb max for hot
maxDataSize = 200

# Expire data after 2 weeks

BTW, you can force a delete of events older than 2 weeks by searching for events more than two weeks old, then piping that search through the | delete command. However, this does not free up any disk space; so I'm guessing this isn't what your looking for.

Super Champion

Can you post your current index settings for the index in question. (You can run btool indexes layer <your_index_name> to show all the settings applied to your index.)

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...