We are currently indexing big log files (~1 GB in size) in our Splunk indexer using Splunk Universal Forwarder.
All the logs data will be stored in a single index.
We want to make sure the logs data is deleted after one week from the date it was indexed.
Is there a way to achieve the same?
Use the frozenTimePeriodInSecs setting in indexes.conf to control how long data lives in the index.
[myindex]
frozenTimePeriodInSecs = 604800