Which setting in indexes.conf allows data retention to be controlled by time?

The correct answer is D. frozenTimePeriodlnSecs. In indexes.conf, the setting frozenTimePeriodInSecs controls data retention by time. It defines the maximum age of data (in seconds) before it is moved to the frozen state and deleted (or archived if coldToFrozenDir is set). For example, setting frozenTimePeriodInSecs = 2592000 r

Splunk Indexing

Question

Exhibit

Options

AmaxDaysToKeep
BmoveToFrozenAfter
CmaxDataRetentionTime
DfrozenTimePeriodlnSecs

How the community answered

(30 responses)

A
7% (2)
B
3% (1)
D
90% (27)

Explanation

In indexes.conf, the setting frozenTimePeriodInSecs controls data retention by time. It defines the maximum age of data (in seconds) before it is moved to the frozen state and deleted (or archived if coldToFrozenDir is set). For example, setting frozenTimePeriodInSecs = 2592000 retains data for 30 days. The other options - maxDaysToKeep, moveToFrozenAfter, and maxDataRetentionTime - are not valid Splunk indexes.conf parameters and do not exist in the Splunk configuration schema.

Topics

#indexes.conf#Data Retention#Time-based Retention#Frozen Buckets

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice