Splunk Search

Search for license violation history all time

Quiad
New Member

Hi! How can i find all the violations in the past? I have tried using this search and change time to all time but only get 31 rows ( one month)

index=_internal source=*license_usage.log type=Usage | timechart span=1d eval(round(sum(b)/1024/1024/1024,2)) AS "Total GB Used"

Why is this search not showing all time? What am i missing?

Cheers!

Tags (1)
0 Karma
1 Solution

ludoz13
Path Finder

Hi,

By default, the retention of _internal index is 30 days. If you do not modify the default settings, you have no more data after 30 days (frozenTimePeriodInSecs = 2592000)

To avoid this, change this settings. Create indexes.conf on the directory SPLUNK_HOME/etc/system/local/indexes.conf and put this settings :

[_internal]
frozenTimePeriodInSecs = xxxxxxxxxx

Regards,

View solution in original post

ludoz13
Path Finder

Hi,

By default, the retention of _internal index is 30 days. If you do not modify the default settings, you have no more data after 30 days (frozenTimePeriodInSecs = 2592000)

To avoid this, change this settings. Create indexes.conf on the directory SPLUNK_HOME/etc/system/local/indexes.conf and put this settings :

[_internal]
frozenTimePeriodInSecs = xxxxxxxxxx

Regards,

Quiad
New Member

Thanks! Makes sense!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...