Hi,
I have a Splunk cluster that consists of:
- 1 cluster master
- 3 indexers
- 1 search head
The indexes at the search head are configured to be forwarded to the indexers.
I would like to set a retention period shorter than the 6-year default to the _audit index in this Splunk cluster.
Normally, to deploy indexes to the indexers, the procedure I use is to create an app with an indexes.conf inside the cluster master's master-apps directory, then push the configuration. However, I'm unsure if this procedure would work for _audit.
How should I go about changing the retention period of the _audit index in all the indexers?
HI @pcsegal1,
for my experience, you could have two different approaches, both correct and efficient:
TA_Indexers
) located in %SPLUNK_HOME/etc/master-apps
, that contains indexes.conf and eventually props.conf and transforms.conf of all your apps , then put in %SPLUNK_HOME/etc/master-apps/_cluster/local
indexes.conf for internal indexes (as _audit); in this way you divide physically and concettually your configuration files on Indexers Cluster;I prefer the first one, but also the second is correct.
In both cases, remember to add comments to each stanza.
Also the _audit index and the other internal indexes can be managed in this way.
Only one attention: choose the correct retention period related with your security policies and your regulation (e.g. in Italy audit logs must be archived at least for six months).
Ciao and Merry Christmas.
Giuseppe
HI @pcsegal1,
for my experience, you could have two different approaches, both correct and efficient:
TA_Indexers
) located in %SPLUNK_HOME/etc/master-apps
, that contains indexes.conf and eventually props.conf and transforms.conf of all your apps , then put in %SPLUNK_HOME/etc/master-apps/_cluster/local
indexes.conf for internal indexes (as _audit); in this way you divide physically and concettually your configuration files on Indexers Cluster;I prefer the first one, but also the second is correct.
In both cases, remember to add comments to each stanza.
Also the _audit index and the other internal indexes can be managed in this way.
Only one attention: choose the correct retention period related with your security policies and your regulation (e.g. in Italy audit logs must be archived at least for six months).
Ciao and Merry Christmas.
Giuseppe
I applied your first approach (put in %SPLUNK_HOME/etc/master-apps/_cluster/local
an indexes.conf
file for the _audit
index) and it worked as expected. Thank you and Merry Christmas.