topic Re: How can we view the data retention policy we have set? in Getting Data In

How can we view the data retention policy we have set?

anandhalagarasa — Mon, 16 Oct 2017 11:14:02 GMT

Hi All,

We have set the data retention has 1 year (365 days) for in cluster master. But when we search the data in Search and Reporting app for an index then we can able to fetch data more than a year too. For audit purpose we need to track what would be the exact data retention and after that there should not be any logs for the same. But in our case we can able to fetch data more than a year too.

So is there any search query that can able to pull the exact data retention which has been set for all indexes and beyond that there should not be any data for that particular index.

These are the configurations which we have been set in cluster master server under the following folder:

Re: How can we view the data retention policy we have set?

lloydknight — Mon, 16 Oct 2017 11:19:36 GMT

Hello @anandhalagarasan

You may want to check these similar questions.
https://answers.splunk.com/answers/92960/how-to-view-data-retention-settings-in-splunk.html

https://answers.splunk.com/answers/553180/how-to-find-the-retention-period-of-an-index.html

Hope it helps!

Thanks!

Re: How can we view the data retention policy we have set?

anandhalagarasa — Mon, 16 Oct 2017 12:02:16 GMT

Thanks for your swift response.

As per both the links when i checked , the index value has been set for 1 year but when i tried to search the data for any of those index i can able to retrieve for more than a year too..

So kindly help on this.

Re: How can we view the data retention policy we have set?

s2_splunk — Mon, 16 Oct 2017 17:42:22 GMT

Data retention cannot enforce data deletion at an exact point in time. A bucket will be frozen when the youngest/most recent event in the bucket is older than your configured frozenTimePeriodInSecs.

If you need to remove anything older than 1 year from search results, you can schedule a daily search that identifies events that are older than 1 year and uses "| delete" to mark them as deleted. Note that this will not remove the events from your indices, but they will no longer be searchable.

Re: How can we view the data retention policy we have set?

deepashri_123 — Tue, 29 Sep 2020 18:27:43 GMT

Hey anandhalagarasan,

The buckets that are stored is in the form db_newesttime_oldesttime_localid_guid .
So retention of bucket won't happen unless your newest time is under retention period.
So the bucket will be searchable and also the data that is there in the bucket till the oldest_time. That is the reason you are able to see older data.
Hope this helps!!

Re: How can we view the data retention policy we have set?

N92 — Tue, 03 Apr 2018 13:21:58 GMT

Hey @anandhalagarasan

got the solution?