topic Re: historic data not ingesting in Getting Data In

historic data not ingesting

ankithreddy777 — Wed, 09 Nov 2016 15:29:42 GMT

I ingested the logs data to Splunk Uat servers, it got ingested all data including the historic data, But when I ingested same data in to the Splunk Production servers, only current data is ingested. Historic data is not ingested. Is there any settings that should override to ingest historic data. I am not using "ignoreolderthan" in my inputs.conf. My forwarder currently sending data to two groups of indexers.

Re: historic data not ingesting

richgalloway — Wed, 09 Nov 2016 15:36:56 GMT

Does the production Splunk have a different data retention policy? Perhaps historic data is being immediately frozen. Just how old is "historic"?

Re: historic data not ingesting

ankithreddy777 — Wed, 09 Nov 2016 16:31:36 GMT

normal Frozen age for index is 562 days as seen in distributed console of CM. apart from this is there any saperate retention policy for historic data. I have all data in splunk from the point I started ingesting.

Re: historic data not ingesting

chillao123 — Wed, 11 Jan 2017 23:45:10 GMT

Did you check size restrictions?