My main Splunk index is near it's max size (~500GB). Instead of filtering out more data (nullQueue) I'd like to look into the possibility of reducing the amount of historical data it stores (store 2 months of events instead of 3 months). I've heard that some people configure Splunk to keep 6 months and others keep just 1 month. Where can I check and possibly modify this?
Thanks.
Yes it' s possible to setup any bucket retention time, based on the timestamp of the events in the bucket.
check the setting frozenTimePeriodInSecs in indexes.conf (default is ~ 6 years)
see http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/Configureindexstorage
Yes it' s possible to setup any bucket retention time, based on the timestamp of the events in the bucket.
check the setting frozenTimePeriodInSecs in indexes.conf (default is ~ 6 years)
see http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/Configureindexstorage
well. you can just leave it as it is, and it will automatically delete the oldest buckets as needed to stay within the 500GB limit.
Awesome, thanks. We index millions of events/day (and would need many, many terabytes to index over a year) so I have reduced mine from 90 days to 60 days.