topic Data Retention and events from imported files in Getting Data In

Data Retention and events from imported files

santorof — Tue, 22 Sep 2015 15:21:05 GMT

I recently imported a few events from a csv into Splunk. These events were from 2014. Our data retention policy was configured for 180 days. Does the data go cold 180 days from the current date or from when the events were indexed? I cant seem to find the events that were imported a few days ago.

Re: Data Retention and events from imported files

somesoni2 — Tue, 22 Sep 2015 16:00:04 GMT

The retention period of the data is based on the timestamp of the data in a bucket. The bucket names are in format db___* . A bucket is rolled over to frozen when the epochtimeoftheoldestevent is older than your data retention period (180 day in your case) from current time. See more details on how data retention works here.

https://wiki.splunk.com/Deploy:BucketRotationAndRetention

Re: Data Retention and events from imported files

santorof — Thu, 24 Sep 2015 19:29:23 GMT

I read the document but whats not clear is if the time stamp is created when the event hits the bucket or is extracted from the event. This would help me in determining if the data that I ingested was rolled over into frozen from my policy or something else entirely

Re: Data Retention and events from imported files

somesoni2 — Thu, 24 Sep 2015 19:39:10 GMT

The timestamp of the event is depending upon the sourcetype/source/host definition that you define on your Indexer/Heavy forwarder (props.conf). You should check that to identify if the Splunk will take the timestamp from the event data itself OR use the current timestamp.

Re: Data Retention and events from imported files

santorof — Thu, 24 Sep 2015 19:50:41 GMT

Appreciate it thank you. I will take a look.