https://community.splunk.com/t5/Getting-Data-In/How-to-view-data-retention-settings-in-Splunk/m-p/77086#M15768 <PRE><CODE>| rest /services/data/indexes | where disabled = 0 | search NOT title = "_*" | eval currentDBSizeGB = round( currentDBSizeMB / 1024) | where currentDBSizeGB &gt; 0 | table splunk_server title summaryHomePath_expanded minTime maxTime currentDBSizeGB totalEventCount frozenTimePeriodInSecs coldToFrozenDir maxTotalDataSizeMB | rename minTime AS earliest maxTime AS latest summaryHomePath_expanded AS index_path currentDBSizeGB AS index_size totalEventCount AS event_cnt frozenTimePeriodInSecs AS index_retention coldToFrozenDir AS index_path_frozen maxTotalDataSizeMB AS index_size_max title AS index </CODE></PRE> Fri, 17 Jul 2015 12:24:19 GMT landen99 2015-07-17T12:24:19Z https://community.splunk.com/t5/Getting-Data-In/How-to-view-data-retention-settings-in-Splunk/m-p/77083#M15765 <P>Was wondering how I can view my data retention settings in Splunk. Installation is on a Linux platform. </P> Thu, 27 Jun 2013 01:58:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-view-data-retention-settings-in-Splunk/m-p/77083#M15765 rgilliam 2013-06-27T01:58:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-view-data-retention-settings-in-Splunk/m-p/77084#M15766 <P>This is found in indexes.conf and is set on a per-index level.</P> <P>The parameter is called <CODE>FrozenTimePeriodInSecs</CODE> and is expressed in seconds. If it does not exist, then the default value of 188697600 is used, which is approximately 6 years.</P> <P>Read more in the docs,</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy">http://docs.splunk.com/Documentation/Splunk/5.0.3/Indexer/Setaretirementandarchivingpolicy</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstorage">http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Configureindexstorage</A></P> <P>Hope this helps,</P> <P>Kristian</P> Thu, 27 Jun 2013 10:45:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-view-data-retention-settings-in-Splunk/m-p/77084#M15766 kristian_kolb 2013-06-27T10:45:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-view-data-retention-settings-in-Splunk/m-p/77085#M15767 <P>You can only directly set a maximum retention period. </P> <P>The way to 'set' a minimum retention period is to manually calculate how fast you are accumulating logs and then make sure you have allocated enough disk space to your indexes. </P> Tue, 23 Jun 2015 05:26:46 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-view-data-retention-settings-in-Splunk/m-p/77085#M15767 ben363 2015-06-23T05:26:46Z https://community.splunk.com/t5/Getting-Data-In/How-to-view-data-retention-settings-in-Splunk/m-p/77086#M15768 <PRE><CODE>| rest /services/data/indexes | where disabled = 0 | search NOT title = "_*" | eval currentDBSizeGB = round( currentDBSizeMB / 1024) | where currentDBSizeGB &gt; 0 | table splunk_server title summaryHomePath_expanded minTime maxTime currentDBSizeGB totalEventCount frozenTimePeriodInSecs coldToFrozenDir maxTotalDataSizeMB | rename minTime AS earliest maxTime AS latest summaryHomePath_expanded AS index_path currentDBSizeGB AS index_size totalEventCount AS event_cnt frozenTimePeriodInSecs AS index_retention coldToFrozenDir AS index_path_frozen maxTotalDataSizeMB AS index_size_max title AS index </CODE></PRE> Fri, 17 Jul 2015 12:24:19 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-view-data-retention-settings-in-Splunk/m-p/77086#M15768 landen99 2015-07-17T12:24:19Z