Clicky

Changing the Layer8Insight Data Retention Limits in Splunk

Splunk will retain data for a substantial amount of time by default. At the time of writing this, the default retention period is 6 years.

Like other configuration changes in Splunk, the general rule is to change the configuration by setting a new value in a "local" folder, not the original configuration file. Note, your Splunk data administrator should dictate where to make the addition/change to the Splunk data retention limits for the Layer8Insight agent data. They are most knowledgeable about how configuration files are maintained in your environment.

What follows are example stanzas and the appropriate setting to use to control the retention limits. 

[layer8]
frozenTimePeriodInSecs = <nonnegative integer> <-- new retention period in seconds

[summary_layer8]
frozenTimePeriodInSecs = <nonnegative integer> <-- new retention period in seconds

See this page for more details on the configuration setting "frozenTimePeriodInSecs".

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.
Powered by Zendesk