Is this applied (or can it be applied) on an index-by-index basis, or does it apply to everything on the indexer? For example, I have one index containing data of a type that I want to freeze after 90 days (7776000 seconds), but another index containing data that I want to keep for as long as possible (for now, 188697600 seconds).
Can I simply add frozenTimePeriodInSecs in indexes.conf to the index I want to truncate earlier and not to the second one (or add it to the second one with the default number of seconds applied)?
E.g.:
[90day_index]
frozenTimePeriodInSecs = 7776000
[forever_index]
frozenTimePeriodInSecs = 188697600
You set it in indexes.conf on an index per index basis.
And yes you can do it exactly as you state.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy
You set it in indexes.conf on an index per index basis.
And yes you can do it exactly as you state.
http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy
Thank you for the link update!
Thanks for the speedy response!