Getting Data In

Retention index or log 90 days

jirakritwang
Engager

Hi. I use Splunk 6.1 free version, Can i config splunk for keep index or log 90 days and delete index or log older than 90 days.

Thank you.
Jira

Tags (1)

Ayn
Legend

Yes. Check out the frozenTimePeriodInSecs setting in indexes.conf. By setting this to 7776000 (90 days in seconds) Splunk will delete data in its index when it becomes older than this limit. You're asking about deleting "index or log" - not sure what you mean by that, but Splunk will not delete any of the actual log files that it's read data from, that's something you need to set up separately.

http://docs.splunk.com/Documentation/Splunk/6.1/Admin/Indexesconf

somesoni2
SplunkTrust
SplunkTrust

The data older than frozenTimePeriodInSecs will get deleted from Splunk. This setting is per index, not global. Setting a higher value of frozenTimePeriodInSecs for summary indexes will ensure that summary index data is retained for longer period.

0 Karma

dhavamanis
Builder

Thank you!, i want to delete the indexed data / log. Sorry for the confusion. seems this frozenTimePeriodInSecs needs to enable per index, not for global. can you please confirm?. Also can you please provide the steps to retain summary index as historical data.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...