https://community.splunk.com/t5/Getting-Data-In/Log-Retention/m-p/38084#M6983 <P>Hello MW, Thank you for the valuable answer. With regards to my query, i can see that this is possible only in licensed version-is that true? if not then please guide me in setting up the retention policy</P> Tue, 12 Jul 2011 12:52:10 GMT infosec_skrc 2011-07-12T12:52:10Z https://community.splunk.com/t5/Getting-Data-In/Log-Retention/m-p/38082#M6981 <P>Hi all,</P> <P>I've studied that Splunk is capable of retenting the original logs feed in to it, also audit the changes if any done to those original logs. Is this correct?<BR /> If yes, I could not find the related docs to configure so. I am running Splunk 4.2 free version. I need the original logs for audit purpose.Can someone help me in this.. Thanks in advance</P> Tue, 05 Jul 2011 12:26:21 GMT https://community.splunk.com/t5/Getting-Data-In/Log-Retention/m-p/38082#M6981 infosec_skrc 2011-07-05T12:26:21Z https://community.splunk.com/t5/Getting-Data-In/Log-Retention/m-p/38083#M6982 <P>Splunk does retain the original event. You can configure block signing to verify the integrity of those events (as they were stored in the Splunk index): <A href="http://www.splunk.com/base/Documentation/latest/admin/ITDataSigning">http://www.splunk.com/base/Documentation/latest/admin/ITDataSigning</A></P> Tue, 05 Jul 2011 12:46:19 GMT https://community.splunk.com/t5/Getting-Data-In/Log-Retention/m-p/38083#M6982 mw 2011-07-05T12:46:19Z https://community.splunk.com/t5/Getting-Data-In/Log-Retention/m-p/38084#M6983 <P>Hello MW, Thank you for the valuable answer. With regards to my query, i can see that this is possible only in licensed version-is that true? if not then please guide me in setting up the retention policy</P> Tue, 12 Jul 2011 12:52:10 GMT https://community.splunk.com/t5/Getting-Data-In/Log-Retention/m-p/38084#M6983 infosec_skrc 2011-07-12T12:52:10Z