Change the index retention period

Improve performance by reducing the index retention period for the _dsphonehome index.

Performance issues in agent management can cause slow responses from the deployment/server/clients endpoint. The following symptoms indicate a performance issue:
  • The response from the endpoint deployment/server/clients takes more than 30 seconds.
  • The Agent Management home page takes more than 30 seconds to load.
  • Searching by host name or app takes more than 30 seconds to complete.
  • The list of matched agents for server class takes more than 30 seconds to load.
  1. Evaluate if reducing the index retention period is appropriate for your environment.

    By default, the index retention period of the _dsphonehome index is 7 days. If you have many agents that phone home frequently, the data gathered during the 7-day period can be too large and causes performance degradation. To improve performance, you can change the retention time period of the total phone home data stored.

    The index retention period for the _dsphonehome index is defined by the frozenTimePeriodInSecs setting in the [_dsphonehome] stanza in the $SPLUNK_HOME/etc/apps/SplunkDeploymentServerConfig/default/indexes.conf file. You can overwrite this value. Note that the retention time period is the minimum time the data is available in the index. The data might remain in the index after the retention time period, depending on the index bucket contents.

    Note: If you change the index retention period, data from offline agents stops appearing after the new retention period. For example, if you want to see offline agents for up to 3 days, the retention time period cannot be lower than 3 days.
  2. Create the $SPLUNK_HOME/etc/apps/SplunkDeploymentServerConfig/local/indexes.conf file on agent management.

    If this file already exists, go to the next step.

  3. Modify the frozenTimePeriodInSecs setting in the [_dsphonehome] stanza in the $SPLUNK_HOME/etc/apps/SplunkDeploymentServerConfig/local/indexes.conf file.

    For example, to modify the retention period to 3 days, insert the following stanza:

    [_dsphonehome]
frozenTimePeriodInSecs = 259200

    Where: 259200 = 3 (days) * 86400 (seconds in a day)

  4. Restart agent management using the splunk restart command.