Which setting in indexes.conf allows data retention to be controlled by time?
Which setting in indexes.conf allows data retention to be controlled by time?
The setting in indexes.conf that allows data retention to be controlled by time is 'frozenTimePeriodInSecs'. This attribute specifies the number of seconds that should pass before the data is considered frozen, essentially controlling how long data is retained based on time.
D - Sys Admin slide 131 for me (indexes.conf options listed on slide 126).
Please help me with the Sys admin PDF.
D is correct
understand better with this link: https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy
Agreed D. Quoting the provided URL reference, "To specify the age at which data freezes, edit the frozenTimePeriodInSecs attribute in indexes.conf. This attribute specifies the number of seconds to elapse before data gets frozen. "
Answer: D
D is correct
D. frozenTimePeriodInSecs
I did a quickly search and the only option seems to be frozenTimePeriodInSecs (the other options isn't additional configurations of indexes.conf)
Ans is D for sure
System Admin - Slide 116
Please can you share with me the PDF file? Thank you!
D is correct
Answer is D
D is right answer.