Getting Data In

I only want to index the last 365 days of data. Can this be done?

coryjackson
New Member

I only want to index the last 365 days of data. Can this be done in Splunk 4.1? Any data older than one year should be purged from the index.

Tags (1)
0 Karma

vbumgarner
Contributor

Configure frozenTimePeriodInSecs in indexes.conf. This is the point at which data is tossed from the index. You will also want to configure maxTotalDataSizeMB to keep your disk from filling. Just in case.

David
Splunk Employee
Splunk Employee

Additionally, you should make sure the amount of data in each bucket is appropriate. If you have the max time period defined to 365*24*60*60 = 31536000 seconds, it will only delete when the bucket rolls over to warm, and the newest event is older than 1 year.

http://www.splunk.com/wiki/Deploy:UnderstandingBuckets

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...