The following are the spec and example files for
# This file contains attributes and values for defining how long notable event metadata remains # in the KV store before it moves to the 'itsi_notable_archive' index. # # There is an itsi_notable_event_retention.conf in $SPLUNK_HOME/etc/apps/SA-ITOA/default/. # To set custom configurations, place an itsi_notable_event_retention.conf in # $SPLUNK_HOME/etc/apps/SA-ITOA/local/. You must restart Splunk to enable # configurations. # # To learn more about configuration files (including precedence) please see # the documentation located at # http://docs.splunk.com/Documentation/ITSI/latest/Configure/ListofITSIconfigurationfiles
# Use the [default] stanza to define any global settings. # * You can also define global settings outside of any stanza, at the top # of the file. # * Each .conf file should have at most one default stanza. If there are # multiple default stanzas, attributes are combined. In the case of # multiple definitions of the same attribute, the last definition in the # file wins. # * If an attribute is defined at both the global level and in a specific # stanza, the value in the specific stanza takes precedence.
retentionTimeInSec = <seconds> * The amount of time, in seconds, to retain the notable event object type. * Default: 15768000 (6 months) retentionObjectCount = <number of objects> * The maximum number of a single object type (for example, notable_event_comment) to retain in the KV store. * The retention policy runs every hour. If the retention count is 50,000 and a KV store collection exceeds 50,000 objects, * the oldest objects are moved to the archive index so the collection only has 50,000 objects. * Default: 50000 disabled = 0|1 * Whether this stanza is enabled or disabled. * If "1", the stanza is disabled. * If "0", the stanza is enabled. object_type = <string> * The notable event object type to retain. * For example, comments, tags, external tickets, and so on. * Required. * If 'object_type' is not specified, the entire stanza is ignored.