topic Data loss after a week for an Index in Splunk in Getting Data In

Data loss after a week for an Index in Splunk

rchittip — Tue, 26 Jun 2018 11:59:52 GMT

I have around 700 forwarders send the data to splunk and no index will keep data longer than 90 days.

My indexed data seems to be fine for last one week.
However, If i go for search before a week, number of returned data is significantly very low. I have been observing this issue from past one month. Data and number of returned hosts for a search is very very low before a week.

Can anyone suggests what is happening and why splunk is behaving like this.

Thanks,
Ramu Chittiprolu

Re: Data loss after a week for an Index in Splunk

renjith_nair — Tue, 26 Jun 2018 12:09:09 GMT

Check other data retention parameters like maxTotalDataSizeMB

Re: Data loss after a week for an Index in Splunk

DalJeanis — Tue, 26 Jun 2018 16:42:17 GMT

Your explanation is here...

https://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/HowSplunkstoresindexes

Pay special attention to the links at the bottom of the page.

Your system is configured to roll your data off to cold storage, probably after a certain amount of size. Check the machine to see how much of its storage it is using, and the average size of the buckets.