Setting data retention policies for specific indexes

Applicability

Splunk Enterprise

Description

When managing retention policies for indexes it's common to use global settings, however, there are occasions where a specific index may need to store data for more or less time than the default. 
 

Investigation

It is possible to set different retention policies for a single index while the rest are managed in a global setting. 
When an attribute is defined at both the global level and in a specific (index) stanza, the value in the specific stanza takes precedence.
Below there is an example, where test indexes will take the frozenTimePeriodInSecs = 31536000. The other indexes would take the global (default) settings.
 

[default]
frozenTimePeriodInSecs = 188697600[test]
frozenTimePeriodInSecs = 31536000

 

See more information on indexes configuration: 
Indexes.conf
Set a retirement and archiving policy

Resolution

In summary, to configure a single index to have a different retention policy than the global, add the frozenTimePeriodInSecs attribute to the index-specific stanza and it will take precedence over the global.
Also, it's important to note that when a setting is not configured at the global level, nor at the individual stanza, it will take the default value, for example frozenTimePeriodInSecs default is 6 years.
 

Related Links

Indexes.conf
Set a retirement and archiving policy

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release