Splunk Dev

Log retention for 1 year

Isaor
New Member

Hello,

How it´s possible to retain the logs of my splunk during 1 year?. I need to modify a parameter?. Whats is the default time of retention of logs? and how can i validate that.

Tags (1)
0 Karma

Isaor
New Member

Hello,

I check the index.conf, but i don´t see my index that i created.

0 Karma

kmugglet
Communicator

Hi @isaor,

The retention times are set in indexes.conf
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf

For the retention time you set the frozenTimePeriodInSecs

This is the example for the cold to frozen retention period.

    frozenTimePeriodInSecs = <nonnegative integer>
    * Number of seconds after which indexed data rolls to frozen.
    * If you do not specify a coldToFrozenScript, data is deleted when rolled to
      frozen.
    * IMPORTANT: Every event in the DB must be older than frozenTimePeriodInSecs
      before it will roll. Then, the DB will be frozen the next time splunkd
      checks (based on rotatePeriodInSecs attribute).
    * Highest legal value is 4294967295
    * Defaults to 188697600 (6 years).

For 1 year, you would set the value to 31556926 seconds

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...