Deployment Architecture

How is frozenTimePeriodInSecs applied?

redc
Builder

Is this applied (or can it be applied) on an index-by-index basis, or does it apply to everything on the indexer? For example, I have one index containing data of a type that I want to freeze after 90 days (7776000 seconds), but another index containing data that I want to keep for as long as possible (for now, 188697600 seconds).

Can I simply add frozenTimePeriodInSecs in indexes.conf to the index I want to truncate earlier and not to the second one (or add it to the second one with the default number of seconds applied)?

E.g.:

[90day_index]
frozenTimePeriodInSecs = 7776000

[forever_index]
frozenTimePeriodInSecs = 188697600
Tags (1)
0 Karma
1 Solution

aelliott
Motivator

You set it in indexes.conf on an index per index basis.
And yes you can do it exactly as you state.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy

View solution in original post

0 Karma

aelliott
Motivator

You set it in indexes.conf on an index per index basis.
And yes you can do it exactly as you state.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy

0 Karma

cave_splunker
Explorer

Thank you for the link update!

0 Karma

redc
Builder

Thanks for the speedy response!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...