How to purge old syslog events in Splunk?

benbeard — Fri, 26 Aug 2016 13:40:24 GMT

I can't for the life of me figure out how to purge old syslog entries in Splunk.

Tech details:
My 1st time using Splunk
Using Splunk on Windows Server 2012
Listening over UDP on 514 from Meraki devices.

Is there a way I can set a max number of entries and anything over the max falls off, or at least only keep the last 7-14 days of entries?

I'm currently at about 13,000,000 entries.

Re: How to purge old syslog events in Splunk?

micahkemp — Fri, 26 Aug 2016 16:36:30 GMT

Event expiration happens at the index level. You can't (using normal Splunk practices) expire from a single sourcetype/host/etc.

Take a look at indexes.conf doc:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Indexesconf

maxTotalDataSizeMB =
* The maximum size of an index (in MB).
* If an index grows larger than the maximum size, the oldest data is frozen.
* This parameter only applies to hot, warm, and cold buckets. It does not
apply to thawed buckets.
* Highest legal value is 4294967295
* Defaults to 500000.

frozenTimePeriodInSecs =
* Number of seconds after which indexed data rolls to frozen.
* If you do not specify a coldToFrozenScript, data is deleted when rolled to
frozen.
* IMPORTANT: Every event in the DB must be older than frozenTimePeriodInSecs
before it will roll. Then, the DB will be frozen the next time splunkd
checks (based on rotatePeriodInSecs attribute).
* Highest legal value is 4294967295
* Defaults to 188697600 (6 years).

topic How to purge old syslog events in Splunk? in Getting Data In

How to purge old syslog events in Splunk?

Re: How to purge old syslog events in Splunk?