topic Re: Splunk Periodic Cleanup Activities in Deployment Architecture

Splunk Periodic Cleanup Activities

tk111 — Wed, 02 Jun 2021 23:29:41 GMT

With Splunk for Windows and Splunk Enterprise Security. Are there specific periodic maintenance tasks that need to be done? For example every few months a cache needs to be cleared?

Re: Splunk Periodic Cleanup Activities

gcusello — Thu, 03 Jun 2021 06:49:53 GMT

Hi @tk111,

there isn't any periodic maintenence needed in Splunk.

The only needed maintenence are to:

upgrade Splunk when there are new releases;
intervene when there's some problem (e.g. data integrity checks).

Data retention is automatically managed by Splunk.

Obviously you need to back-up your data and configurations!

Ciao.

Giuseppe

Re: Splunk Periodic Cleanup Activities

tk111 — Thu, 03 Jun 2021 18:57:48 GMT

Thanks @gcusello that is helpful.

Do data integrity checks need to be performed periodically?

I'm assuming we'd be able to perform them following this:

https://docs.splunk.com/Documentation/Splunk/8.2.0/Security/Dataintegritycontrol

Re: Splunk Periodic Cleanup Activities

gcusello — Fri, 04 Jun 2021 06:12:56 GMT

Hi @tk111,

if you enable Integrity Check on all your indexes, you don't need to plan it because Splunk automatically does it.

If this answer solves your need, please accept it for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉