Getting Data In

How to configure 90/180/366 days retention for an index?

srmohan
New Member

We would like to enable frozenTimePeriodInSecs and enableTsidxReduction = true with timePeriodInSecBeforeTsidxReduction. Keeping both settings as the same values, can we achieve the targeted days of retention?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @srmohan,

As you might have already figured out, frozenTimePeriodInSecs and timePeriodInSecBeforeTsidxReduction are used for completely different purposes.

  • frozenTimePeriodInSecs - Removes data which is older than this time
  • timePeriodInSecBeforeTsidxReduction - Reduces tsidx files by replacing it with a smaller version but your rawdata and metadata still remains untouched. So you save some disk space but searches involving this files might be slower.

Keeping the same value for both settings might not help you to achieve your goal since it removes the data and there is nothing for tsidx reduction to do or tsidx redution happens and the removal of data happens immediately based on which order splunk checks for these values

For your reference : http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Reducetsidxdiskusage

frozenTimePeriodInSecs = <nonnegative integer>
* Number of seconds after which indexed data rolls to frozen.
* If you do not specify a coldToFrozenScript, data is deleted when rolled to
  frozen.
* IMPORTANT: Every event in the DB must be older than frozenTimePeriodInSecs
  before it will roll. Then, the DB will be frozen the next time splunkd
  checks (based on rotatePeriodInSecs attribute).
* Highest legal value is 4294967295
* Defaults to 188697600 (6 years).
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...