Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

frozenTimePeriodInSecs points to age of data only in cold bucket or summation of all stages i.e Hot, Warm and Cold ?

$
0
0
My client requires 30 day "active" storage and 90 day "cold" storage standard. So, total data should be deleted after 120 days. below is my current retention setting for main index, maxHotSpanSecs = 2592000 [hot bucket - 30 days] maxHotIdleSecs = 0 frozenTimePeriodInSecs = 7776000 [cold bucket - 90 days] maxTotalDataSizeMB = 250000 Assuming frozenTimePeriodInSecs depends on age of data in cold bucket, data will get rolled from hot bucket after 30 days to warm/cold and after 90 days in cold bucket, it will get rolled to frozen. But I am not sure if my understanding is correct. Please advise me the correct way to do this.

Viewing all articles
Browse latest Browse all 47296

Trending Articles