https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-keep-internal-data-longer-than-30/m-p/272700#M52385 <P>I have a global of 90days, so just assumed it included _internal. </P> <P>Thanks for the quick response.</P> Tue, 09 Feb 2016 12:56:31 GMT ralphw_SAIC 2016-02-09T12:56:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-keep-internal-data-longer-than-30/m-p/272698#M52383 <P>For some reason _internal is only available for the last 30 days even though it has not reached its max size limit stated in indexes.conf. Is there any way to increase the retention time for _internal and if so where?</P> Mon, 08 Feb 2016 17:19:05 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-keep-internal-data-longer-than-30/m-p/272698#M52383 ralphw_SAIC 2016-02-08T17:19:05Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-keep-internal-data-longer-than-30/m-p/272699#M52384 <P>By default, this index is configured to freeze or "archive" data after 30 days. You can customize the "frozenTimePeriodInSecs" attribute for the index. Just replace the value below to the retention period you want in an indexes.conf file in $SPLUNK_HOME/etc/system/local/ or in $SPLUNK_HOME/etc/apps/&lt; app_name &gt; if deploying the configuration via an app. </P> <P>---indexes.conf---<BR /> [_internal]<BR /> frozenTimePeriodInSecs = 2592000</P> Tue, 29 Sep 2020 08:41:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-keep-internal-data-longer-than-30/m-p/272699#M52384 anshu 2020-09-29T08:41:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-keep-internal-data-longer-than-30/m-p/272700#M52385 <P>I have a global of 90days, so just assumed it included _internal. </P> <P>Thanks for the quick response.</P> Tue, 09 Feb 2016 12:56:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-keep-internal-data-longer-than-30/m-p/272700#M52385 ralphw_SAIC 2016-02-09T12:56:31Z