itsi_notable_event_retention.conf

The following are the spec and example files for itsi_notable_event_retention.conf.

itsi_notable_event_retention.conf.spec

# This file contains attributes and values for defining how long notable event metadata remains
# in the KV store before it moves to the 'itsi_notable_archive' index.
#
# There is an itsi_notable_event_retention.conf in $SPLUNK_HOME/etc/apps/SA-ITOA/default/.
# To set custom configurations, place an itsi_notable_event_retention.conf in
# $SPLUNK_HOME/etc/apps/SA-ITOA/local/. You must restart Splunk to enable
# configurations.
#
# To learn more about configuration files (including precedence) please see
# the documentation located at
# http://docs.splunk.com/Documentation/ITSI/latest/Configure/ListofITSIconfigurationfiles

GLOBAL SETTINGS

# Use the [default] stanza to define any global settings.
#  * You can also define global settings outside of any stanza, at the top
#    of the file.
#  * Each .conf file should have at most one default stanza. If there are
#    multiple default stanzas, attributes are combined. In the case of
#    multiple definitions of the same attribute, the last definition in the
#    file wins.
#  * If an attribute is defined at both the global level and in a specific
#    stanza, the value in the specific stanza takes precedence.

[<collection_name>]

retentionTimeInSec = <seconds>
* The amount of time, in seconds, to retain the notable event object type.
* Default: 15768000 (6 months)

retentionObjectCount = <number of objects>
* The maximum number of a single object type (for example, notable_event_comment) to retain in the KV store.
* The retention policy runs every hour. If the retention count is 50,000 and a KV store collection exceeds 50,000 objects,
* the oldest objects are moved to the archive index so the collection only has 50,000 objects.
* Default: 50000

disabled = 0|1
* Whether this stanza is enabled or disabled.
* If "1", the stanza is disabled.
* If "0", the stanza is enabled.

object_type = <string>
* The notable event object type to retain.
* For example, comments, tags, external tickets, and so on.
* Required.
* If 'object_type' is not specified, the entire stanza is ignored.

itsi_notable_event_retention.conf.example

No example