topic Re: Splunk indexing retention policy in Getting Data In

Splunk indexing retention policy

SS1 — Tue, 13 Oct 2020 20:25:48 GMT

hello Splunkers,

We have a index whose retention pol;icy is varying for the applications that are reporting to that index. For example, Application 1 we can see the logs from August and for application 2 we can see the logs from September, both applications are reporting to same index. I know we can set the retention policy per index. Is there any setting that we are missing here?

Re: Splunk indexing retention policy

richgalloway — Tue, 13 Oct 2020 21:15:39 GMT

Different apps can set the various values for each index however they choose. Those settings are merged with the final value dependent on the names of the defining apps. That's why it's important for the Splunk admin to reconcile each app's settings to something that makes sense for the local environment. Apps are discouraged from shipping an indexes.conf file that contains enabled indexes for the same reason.

That said, if both indexes are truly writing to the same index then they should be seeing the same data. That they are not seeing the same data tells me something is different between the apps. Use btool to see if you can identify the difference(s).

splunk btool --debug indexes list -app=Application1 > app1.txt splunk btool --debug indexes list -app=Application2 > app2.txt diff app1.txt app2.txt

Re: Splunk indexing retention policy

SS1 — Tue, 13 Oct 2020 21:49:29 GMT

Hi,

Both the applications are indexing into only 1 index, they don't index to any other indexer. and we dont use seperate index.conf for applications

Re: Splunk indexing retention policy

SS1 — Tue, 13 Oct 2020 22:47:30 GMT

Does both application get archived in different buckets? and the retention policy apply differently to different buckets?

Re: Splunk indexing retention policy

SS1 — Tue, 13 Oct 2020 23:02:39 GMT

by app i meant a java application not the splunk app