topic Default setting for splunk log retention in Getting Data In

Default setting for splunk log retention

yuwtennis — Mon, 28 Sep 2020 15:30:26 GMT

Hi!

I see that splunk manages its logs with log.cfg

However, not all the logs are listed in this configuration file.(web_service.log, web_access.log,btool.log,etc)
Is it correct to understand, the default setting for maxBackupIndex and maxFileSize
as following?

maxBackupIndex = 5
maxFileSize = 25MB

Thanks,
Yu

Re: Default setting for splunk log retention

kristian_kolb — Wed, 18 Dec 2013 10:33:32 GMT

Well, that's for the files on disk, but they are also indexed by Splunk, and are found in the _internal index, where they are retained for (default) 30 days.

Re: Default setting for splunk log retention

yuwtennis — Wed, 18 Dec 2013 10:47:08 GMT

hello kristian.

Thank you for the reply.

Yes . I wanted to know the retention policy for the files.

Thanks,
Yu