- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Only 30 days searchable on any index
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check Manager>Indexes to verify you have data older than 30 days.
You can also use an epoch timestamp converter to check the time stamps on the buckets in your indexes. The buckets are named with the following format: var/lib/splunk/defaultdb/db/db_oldestEvent_newestEvent_uniqueID
If you don't have any data that is older than 30 days then check for the attribute frozenTimePeriodInSecs in your indexes.conf. This is typically found in the etc/system/default or local directories, but it might be configured in any app default or local directories. This can be set as a default and on an index per index basis.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check Manager>Indexes to verify you have data older than 30 days.
You can also use an epoch timestamp converter to check the time stamps on the buckets in your indexes. The buckets are named with the following format: var/lib/splunk/defaultdb/db/db_oldestEvent_newestEvent_uniqueID
If you don't have any data that is older than 30 days then check for the attribute frozenTimePeriodInSecs in your indexes.conf. This is typically found in the etc/system/default or local directories, but it might be configured in any app default or local directories. This can be set as a default and on an index per index basis.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Luke, Thanks for that.. I think I found the answer. The non internal indexes go back to 2010 in cold, but some of the dashboards in use, use the _internal index which is not in cold and only has 30 days of history. Looking in /opt/splunk/etc/system/default/indexes.conf, the frozenTimePeriodInSecs is set to 2419200 which is 28 days.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi MHibbin, Nothing in the splunk logs and splunk has restarted. I think this maybe historical, unfortunately this is something I've inherited so it's hard for me to say when it started.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
have you looked in the splunk logs for anything?
have you restarted splunk? - does it complain about dirty indexes
is this a historical problem? or recent one? - any changes around the time of occurrence?
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
