topic Re: Older data in Getting Data In

Older data

rahul2gupta — Thu, 01 Jul 2021 06:20:36 GMT

Hi ,

Query:

index=main sourcetype="activedirectory"

I performed a search which showed only last 14 days of data. Is there a way to get older data than 14 days. User wants to get data of last 1 year.

Regards,

Rahul

Re: Older data

gcusello — Thu, 01 Jul 2021 06:31:11 GMT

Hi @rahul2gupta,

I think that you used one year as search period in the time picker.

So if you have only 14 days, maybe this is the retention of your main index, check it!

In this case, you cannot have more data now, you can change the retention time in $SPLUNK_HOME/system/local/indexes.conf and in the next months you'll have a longer period.

Obviously, in this case calculate the storage requirents with a Capacity Plan.

Ciao.

Giuseppe

Re: Older data

rahul2gupta — Sat, 03 Jul 2021 08:38:16 GMT

Hi @gcusello ,

I checked the retention period of index=main and found out that it is 6 months. Can you please help me to understand why we are getting only last 14 days data.

Regards,

Rahul Gupta

Re: Older data

gcusello — Sat, 03 Jul 2021 09:28:16 GMT

Hi @rahul2gupta,

please check the dimension of the main index using the Monitoring Console.

I saw that you have a max dimension of 50 Gb for main index, maybe this is the problem, even if I don't think.

Then try a different search to understan if you really have data older than 14 days (using always as time period):

| metasearch index=main | timechart count BY sourcetype

then try

| metasearch index=* sourcetype=activedirectory | timechart count BY index

Ciao.

Giuseppe