You'll want to review this doc: http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy
. You can set retention on a per-index basis, and set the cold to Frozen at 7 days.
You'll want to review this doc: http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy
. You can set retention on a per-index basis, and set the cold to Frozen at 7 days.