View all questions & answers for the SPLK-1003 exam
Which setting in indexes. conf allows data retention to be controlled by time?
maxDaysToKeep
moveToFrozenAfter
maxDataRetentionTime
frozenTimePeriodlnSecs
https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy
Submit