Deployment Architecture

How to configure indexes.conf for bucket retention and rotation policy?

romitsn
New Member

I have an index called "sharp" where currently I have ~ 90 days worth of data in the hotbucket (db directory).

For 90 days worth of data it takes up about 130 gigs of space.

I want to bucket retention and rotation in such a way-
upto 90 days worth of index files = stays in hot bucket ( we should be able to search up to 90 days' data)
more than 90 days worth of index files = can be moved to frozen (can be deleted immediately)

What are the settings I should use in the indexes.conf file?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can set the frozenTimePeriodInSecs property for the index to 7776000 (90 days). The data will be available in Splunk for 90 days and will be move to frozen (deleted unless set a script to archieve it).

Reference.

http://answers.splunk.com/answers/143716/retention-index-or-log-90-days

http://wiki.splunk.com/Deploy:BucketRotationAndRetention

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...