https://community.splunk.com/t5/Getting-Data-In/Syslog-Data-Storage/m-p/22621#M3513 <P>By default indexes are stored in $SPLUNK_HOME/var/lib/splunk</P> <P>You may <A href="http://www.splunk.com/base/Documentation/latest/Admin/Setlimitsondiskusage" rel="nofollow">set limits on disk usage</A> via the GUI or CLI.</P> <P>If you're only interested in the last 14 days of data, you may choose the appropriate time range from the Time Picker next to the search bar. Alternatively, you may specify that within the search itself:</P> <PRE><CODE>sourcetype=syslog earliest=-14d </CODE></PRE> Thu, 29 Jul 2010 22:45:32 GMT bwooden 2010-07-29T22:45:32Z https://community.splunk.com/t5/Getting-Data-In/Syslog-Data-Storage/m-p/22620#M3512 <P>I have version 4.1 and have it set up to recieve syslog data directly from various servers but I only want to hold the data on the server for 14 days, is there a way of configuring this?</P> <P>Also I have been unable to find out where the data is held and how much disk space it is taking up.</P> <P>Thanks</P> Thu, 29 Jul 2010 22:08:53 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-Data-Storage/m-p/22620#M3512 miguel255 2010-07-29T22:08:53Z https://community.splunk.com/t5/Getting-Data-In/Syslog-Data-Storage/m-p/22621#M3513 <P>By default indexes are stored in $SPLUNK_HOME/var/lib/splunk</P> <P>You may <A href="http://www.splunk.com/base/Documentation/latest/Admin/Setlimitsondiskusage" rel="nofollow">set limits on disk usage</A> via the GUI or CLI.</P> <P>If you're only interested in the last 14 days of data, you may choose the appropriate time range from the Time Picker next to the search bar. Alternatively, you may specify that within the search itself:</P> <PRE><CODE>sourcetype=syslog earliest=-14d </CODE></PRE> Thu, 29 Jul 2010 22:45:32 GMT https://community.splunk.com/t5/Getting-Data-In/Syslog-Data-Storage/m-p/22621#M3513 bwooden 2010-07-29T22:45:32Z