Deployment Architecture

can we change index retention at any time?

AzmathShaik
Path Finder

Hello All,

we have multisite cluster environment running our current retention is set to default, can we change our retention now, is it suggested to do? what will be the impact.

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Yes, you can change retention settings for your indices at any time. If you reduce it, Splunk will start rolling off data based on your index configuration.
If you increase it, buckets will be kept longer, according to new retention settings. In this case, make sure you have enough storage across your indexing tier to maintain the longer data retention.

Impact:
- the change requires a rolling restart of your cluster
- if you decrease retention, Splunk will process all buckets to determine which ones should now be archived/deleted. This may take a while, but should not have material impact on indexing and search otherwise

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

Yes, you can change retention settings for your indices at any time. If you reduce it, Splunk will start rolling off data based on your index configuration.
If you increase it, buckets will be kept longer, according to new retention settings. In this case, make sure you have enough storage across your indexing tier to maintain the longer data retention.

Impact:
- the change requires a rolling restart of your cluster
- if you decrease retention, Splunk will process all buckets to determine which ones should now be archived/deleted. This may take a while, but should not have material impact on indexing and search otherwise

AzmathShaik
Path Finder

Thank you.

0 Karma

evgenyvasilchen
Explorer

If we decrease retention - shall this free some disk space?
For example - we have accumulated data for 5 years and now want to set max. retention time to 2 years.
So, if we will set frozenTimePeriodInSecs to two years - will that remove any older buckets off the disk?

Thanks!

0 Karma

dxu_splunk
Splunk Employee
Splunk Employee

^ yes it will. it'll likely use a lot of resources free'ing up so many buckets upon the first restart.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...