how to know the current retention policy

[kteng2024]

Hi,

Is there anyway to know the current retention policy we have in splunk environment for all the indexes ?

[gcusello]

Hi kteng2024,
you can use Distributed Monitoring Console at [Indexing -- Indexes and Volumes -- Index Details - Instance], in the center of the dashboard there is a panel called "Retention policies" in which you can find all index retention information.
Bye.
Giuseppe

[skoelpin]

Yes, go to Settings>Indexes

Look at the max size of all the indexes. The max index size defaults to 500GB or 6 years

Here's a good doc explaining how the index retention works

https://wiki.splunk.com/Deploy:BucketRotationAndRetention