Getting Data In

Log files with differing retention periods

jamesoconnell
Path Finder

Can log files with different retention requirements exist and be accessed within same index?

Regards,
James O'Connell.

Tags (1)
0 Karma

dbcottam
New Member

I have the same question and would like further instruction. How can I set up multiple search indexes? I need one for mail with a retention of four months for example and another index for proxy logs, etc.

How do I set up the indexes to the specific source? Thanks

0 Karma

mikelanghorst
Motivator

No, the retention period is based upon individual indexes. If you have logs with different requirements you'll need to direct them to different indexes. You can configure roles to search multiple indexes by default to make it easier.

0 Karma

jamesoconnell
Path Finder

Thank you Mike for the response. I figured the answer was no, but didn't know about the role configuration across multiple indexes by default.

Let me make sure I understand what you mean -- I know I can setup a given role to search on selected indexes by default when no index is specified -- is this what you mean?

Thanks again,
James O'Connell.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...