topic Re: How to view Splunk data retention without access to indexes.conf? in Getting Data In

How to view Splunk data retention without access to indexes.conf?

wzgoda — Thu, 09 Jun 2016 18:21:24 GMT

Hello-

I am auditing a company and am trying to determine the retention time for Splunk logs. I have been reading that you need access to the indexes.conf file, but I am unable to access it. Is there a command or somewhere else I can look in order to figure out the retention period?

Thanks

Re: How to view Splunk data retention without access to indexes.conf?

jkat54 — Thu, 09 Jun 2016 18:33:17 GMT

Try this:

  |dbinspect | convert ctime(endEpoch) | convert ctime(startEpoch) | table index, endEpoch, startEpoch, rawSize, sizeOnDiskMB, eventCount

Re: How to view Splunk data retention without access to indexes.conf?

justinatpnnl — Thu, 09 Jun 2016 18:39:13 GMT

You can use the rest api from a splunk search:

| rest /services/data/indexes

This should give you all of the configuration info you need.

http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTintrospect#data.2Findexes

Re: How to view Splunk data retention without access to indexes.conf?

christian_clout — Thu, 09 Jun 2016 18:40:49 GMT

The Distribution Management Console also shows information about Data Retention if you are on 6.4.x.

Re: How to view Splunk data retention without access to indexes.conf?

wzgoda — Thu, 09 Jun 2016 18:56:50 GMT

Thanks! this with a dedup on title helped me!

Re: How to view Splunk data retention without access to indexes.conf?

ddrillic — Thu, 09 Jun 2016 19:04:41 GMT

You can run this report which was published at bucket retention and frozenTimePeriodInSecs

The query is -

| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs

Re: How to view Splunk data retention without access to indexes.conf?

ppablo — Fri, 10 Jun 2016 17:23:55 GMT

Hi @wzgoda

Glad you found your answer through @justinatpnnl
I see you upvoted his answer, but please don't forget to actually resolve the post by clicking "Accept" directly below his answer.

Re: How to view Splunk data retention without access to indexes.conf?

SamHTexas — Tue, 27 Apr 2021 19:33:43 GMT

Where in Monitoring console do I find this info. please?