https://community.splunk.com/t5/Splunk-Enterprise-Security/In-Intelligence-Downloads-setting-what-is-Maximum-age/m-p/568154#M10323 <P>Yes, the&nbsp;<STRONG>Maximum age</STRONG><SPAN>&nbsp;field is to define the retention period for this threat source, defined in relative time.&nbsp;</SPAN></P><P><SPAN>The default maximum age is&nbsp;</SPAN>-30d<SPAN>&nbsp;for 30 days of retention in the KV Store. To remove the data more often, use a smaller number such as&nbsp;</SPAN>-7d<SPAN>&nbsp;for one week of retention. The maximum age field cannot be left black because storing the collection indefinitely can impact performance.</SPAN></P><P><SPAN>Basically it&nbsp;removes threat intelligence from the KV Store collections in Splunk Enterprise Security based on the date that the threat intelligence was added to Enterprise Security.</SPAN></P> Wed, 22 Sep 2021 20:54:02 GMT Azeemering 2021-09-22T20:54:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/In-Intelligence-Downloads-setting-what-is-Maximum-age/m-p/567824#M10319 <P>When I configuring threat feeds in ES . In&nbsp; Intelligence Downloads setting there is Maximum age&nbsp;<SPAN>&nbsp;for threat intel downloads. Does anyone know what is Maximum age field.</SPAN></P><P>&nbsp;</P> Tue, 21 Sep 2021 10:39:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/In-Intelligence-Downloads-setting-what-is-Maximum-age/m-p/567824#M10319 Pavankumar 2021-09-21T10:39:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/In-Intelligence-Downloads-setting-what-is-Maximum-age/m-p/568154#M10323 <P>Yes, the&nbsp;<STRONG>Maximum age</STRONG><SPAN>&nbsp;field is to define the retention period for this threat source, defined in relative time.&nbsp;</SPAN></P><P><SPAN>The default maximum age is&nbsp;</SPAN>-30d<SPAN>&nbsp;for 30 days of retention in the KV Store. To remove the data more often, use a smaller number such as&nbsp;</SPAN>-7d<SPAN>&nbsp;for one week of retention. The maximum age field cannot be left black because storing the collection indefinitely can impact performance.</SPAN></P><P><SPAN>Basically it&nbsp;removes threat intelligence from the KV Store collections in Splunk Enterprise Security based on the date that the threat intelligence was added to Enterprise Security.</SPAN></P> Wed, 22 Sep 2021 20:54:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/In-Intelligence-Downloads-setting-what-is-Maximum-age/m-p/568154#M10323 Azeemering 2021-09-22T20:54:02Z