Getting Data In

How to view Splunk data retention without access to indexes.conf?

wzgoda
Explorer

Hello-

I am auditing a company and am trying to determine the retention time for Splunk logs. I have been reading that you need access to the indexes.conf file, but I am unable to access it. Is there a command or somewhere else I can look in order to figure out the retention period?

Thanks

0 Karma
1 Solution

justinatpnnl
Communicator

You can use the rest api from a splunk search:

| rest /services/data/indexes

This should give you all of the configuration info you need.

http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTintrospect#data.2Findexes

View solution in original post

ddrillic
Ultra Champion

You can run this report which was published at bucket retention and frozenTimePeriodInSecs

The query is -

| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs
0 Karma

christian_clout
Explorer

The Distribution Management Console also shows information about Data Retention if you are on 6.4.x.

0 Karma

SamHTexas
Builder

Where in Monitoring console do I find this info. please?

Tags (1)
0 Karma

justinatpnnl
Communicator

You can use the rest api from a splunk search:

| rest /services/data/indexes

This should give you all of the configuration info you need.

http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTintrospect#data.2Findexes

wzgoda
Explorer

Thanks! this with a dedup on title helped me!

0 Karma

ppablo
Retired

Hi @wzgoda

Glad you found your answer through @justinatpnnl
I see you upvoted his answer, but please don't forget to actually resolve the post by clicking "Accept" directly below his answer.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try this:

  |dbinspect | convert ctime(endEpoch) | convert ctime(startEpoch) | table index, endEpoch, startEpoch, rawSize, sizeOnDiskMB, eventCount
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...