I am bit confused on setting up a retention period for an Index in splunk....If i need a retention period of 60 days setting a frozenTimePeriodInSecs = 5184000 will work, if i go with the settings below,
How does the rolling happen from hot to warm, warm to cold and thawed...?
Does this setting says the data is searchable for 30day period before it's deleted...?
What' the typical way to setting this with other options...?
[jra_server]
homePath =
coldPath =
thawedPath =
frozenTimePeriodInSecs = 5184000
↧