Hi guy, how do I go about setting a limit on our data retention.
I need the data on the indexer to be deleted after 2 years, is there a way to do tjis via the web interface or is this somthing that must be done in the inputs.conf on the indexer itself.
Also am I correct in thinking that you have to define the time in seconds if going down the inputs.conf route ?
Cheers
Aaron
No, that's not really correct.
You should have a look at the following reference:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy
But at a highlevel you will need to use the frozenTimePeriodInSecs
parameter for each Index stanza OR globally in your indexes.conf
file.
http://docs.splunk.com/Documentation/Splunk/5.0.3/admin/Indexesconf
Hope this helps.
P.S. Plan this change correctly... you may lose your data incorrectly... would be a good idea to do a backup of data first!