topic Re: Is there a way to audit who has modified the searchable retention period for the various indexes in Splunk cloud in Security

Is there a way to audit who has modified the searchable retention period for the various indexes in Splunk cloud

Ichan — Thu, 28 Oct 2021 05:24:53 GMT

We found that the searchable events for our wineventlog only goes back about 4 months but the searchable retention is set to 2 years 364 days (which is a total of 3 years). Splunk has said that the most likely scenario is that someone has changed the retention period recently. We would like to find out who has modified the searchable retention period.

I have looked in the audit logs but that also only goes back about 5 months and have not found anything useful. I have also googled and have not found any solutions. Would appreciate any help. Thank you.

Re: Is there a way to audit who has modified the searchable retention period for the various indexes in Splunk cloud

isoutamo — Thu, 28 Oct 2021 06:36:43 GMT

another option is that you have lack of disk space and for that reason splunk has frozen those events before retention time has fulfil.

If you haven't have audit logs and haven't set any VCS into use there probably haven't any way to get this info.

For future use you could check this: https://github.com/paychex/Splunk.Conf19

As this is Splunk Cloud, have you bought additional disk capacity over standard 90 days?

r. Ismo