topic Re: Retention period in GUI? in Security

Retention period in GUI?

eroemisch — Thu, 22 Jun 2017 15:21:22 GMT

Hello,
I am novice at best when it comes to Splunk administration. Running Splunk Enterprise through AWS on a Linux instance, I have one Windows box forwarding over logs. I need to set a retention period of 30 days for the logs then I want them to be deleted.

I keep seeing that this setting would be in indexes.conf, but I am not sure how to access that, can this be done through a GUI or do I have to use the CLI?

Re: Retention period in GUI?

gcusello — Thu, 22 Jun 2017 15:27:30 GMT

Hi,
with the current version, you can display retention period using Distributed Monitoring Console, but to set a retention period you can only access the Splunk indexer by CLI and modify indexes.conf.

Bye.
Giuseppe

Re: Retention period in GUI?

eroemisch — Thu, 22 Jun 2017 15:30:50 GMT

Great, thanks for the answer. Is there a default location I should be looking for the indexes.conf? I assume there is a master file that I can set, and if I need to set different times for different servers I can point them to a different conf file?

Re: Retention period in GUI?

gcusello — Thu, 22 Jun 2017 15:41:56 GMT

Hi eroemisch ,
it depends by your indexes.conf files: you can insert them in each app or create an app dedicated to indexes.
The importanto thing (for me) it's to choose a method and follow it in every app.
I'd avoid to put them in launcher or search apps (usually it happens!) and remeber to put your indexes.conf in local folders and not in default folders.

Bye.
Giuseppe

P.S.: if you're satisfied by this answer, please accept it.

Re: Retention period in GUI?

SamHTexas — Tue, 27 Apr 2021 19:38:17 GMT

Grazie, how do I view this info using Monitoring console with Splunk 8.0 & above?