I have a 6.x environment and I want to configure splunk to only retain the last 30 days worth of data. How do I configure this for each indexer. I have 315 GB per indexer. I have 5 indexers. I only want to retain the last 30 days of data on each indexer. I see data files in my indexers(db) that are from 2014 and 2015 in this directory path - /opt/tools/splunk/var/lib/splunk. I setup two indexes, but I also see quite a bit data files in the defaultdb.
↧