Getting Data In

how change sinkhole directory and configure it?

giovere
Path Finder

I'm trying to change sinkhole directory and configure it so that it will delete files only after 5 days or so. Is there a way to achieve this?

Tags (1)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi giovere

you can setup a sinkhole with the batch stanza, meaning you can define any directory as sinkhole. the move_policy sinkhole tells splunk to load the file destructively. there is no way to tell splunk to delete files after five days or so.......

but you could setup a montior stanza instead of a batch stanza and use logadm (on *nix) to rotate/delete the files away after 5 days.

further information about monitor/batch stanzas can go to -> click me

kind regards

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi giovere

you can setup a sinkhole with the batch stanza, meaning you can define any directory as sinkhole. the move_policy sinkhole tells splunk to load the file destructively. there is no way to tell splunk to delete files after five days or so.......

but you could setup a montior stanza instead of a batch stanza and use logadm (on *nix) to rotate/delete the files away after 5 days.

further information about monitor/batch stanzas can go to -> click me

kind regards

giovere
Path Finder

Awesome! thanks ...

0 Karma

Steve_G_
Splunk Employee
Splunk Employee

You can set a retirement policy to remove indexed data when it reaches a configurable age. For details, see:

http://docs.splunk.com/Documentation/Splunk/4.2.3/Admin/Setaretirementandarchivingpolicy

0 Karma

MuS
SplunkTrust
SplunkTrust

you can set various time related settings in indexes.conf http://docs.splunk.com/Documentation/Splunk/4.2.3/admin/Indexesconf I think with some try & error you should be able to achieve this.

0 Karma

giovere
Path Finder

thanks a lot! I'll give it a try tomorrow, do you know if I can remove 5 or so days old data+indexes from the Splunk itself and what's the way to do it?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...