We would like to enable frozenTimePeriodInSecs and enableTsidxReduction = true with timePeriodInSecBeforeTsidxReduction. Keeping both settings as the same values, can we achieve the targeted days of retention?
Hi @srmohan,
As you might have already figured out, frozenTimePeriodInSecs and timePeriodInSecBeforeTsidxReduction are used for completely different purposes.
Keeping the same value for both settings might not help you to achieve your goal since it removes the data and there is nothing for tsidx reduction to do or tsidx redution happens and the removal of data happens immediately based on which order splunk checks for these values
For your reference : http://docs.splunk.com/Documentation/Splunk/6.4.2/Indexer/Reducetsidxdiskusage
frozenTimePeriodInSecs = <nonnegative integer>
* Number of seconds after which indexed data rolls to frozen.
* If you do not specify a coldToFrozenScript, data is deleted when rolled to
frozen.
* IMPORTANT: Every event in the DB must be older than frozenTimePeriodInSecs
before it will roll. Then, the DB will be frozen the next time splunkd
checks (based on rotatePeriodInSecs attribute).
* Highest legal value is 4294967295
* Defaults to 188697600 (6 years).