topic Re: How to search more than 1 year data in Splunk Search

How to search more than 1 year data

brpsingara — Mon, 21 Oct 2019 20:45:52 GMT

Hello,

I want to search more than one year data for particular machine.

How to check is possible to get more than one year data?

Could you please help me.

Thanks in advance.

Re: How to search more than 1 year data

ivanreis — Mon, 21 Oct 2019 21:59:27 GMT

on the splunk time picker you have the option to select the time frame.
you can select date range on the time picker or Data time range
Select All time, please be carefully because it will run a search to all data for that particular host.
other point to consider is about the retention data, so you have to make sure the data is being stored for more than 1h for the particular host

Re: How to search more than 1 year data

brpsingara — Mon, 21 Oct 2019 22:08:45 GMT

Hello Ivanreis,

Thanks for the reply.

I tried with time picker. I selected August 1, 2018 to September 30, 2018. But nothing is showing in the result.

I did search only with Host name of machine "DSS-Patch-DC01"

And also i tried with all indexes.

If possible please tell me how to check the age of data which is stored in splunk.

Re: How to search more than 1 year data

sandeepmakkena — Mon, 21 Oct 2019 22:20:53 GMT

You have to know the retention policy of your index 1st, I don't think you can do that through UI.
You can run this query to get the retention policy in days

| rest /services/data/indexes 
 | rename title as index | dedup index | sort index
 | streamstats count as Row
 | eval Days=frozenTimePeriodInSecs/86400
 | fields Row index frozenTimePeriodInSecs Days

If this info is not good enough, you can ask your Splunk team for more information on the retention policy, with that being answered one more question would be can we query that frozen data the answer is Yes.
here is the link you can refer to https://wiki.splunk.com/Community:UnderstandingBuckets

Thanks! hope this helps.

Re: How to search more than 1 year data

brpsingara — Mon, 21 Oct 2019 22:42:45 GMT

Hello Sandeep,

Thanks for the answer .

I think i do not have rights to run the above commands.

I am getting empty columns for frozenTimePeriodInSecs and Days

i am able to see only index names.

Is possible to check what is the starting time the data available?

Re: How to search more than 1 year data

sandeepmakkena — Tue, 22 Oct 2019 02:11:30 GMT

| metadata index=YourIndexName type=hosts 
| stats max(lastTime) as lastTime, min(firstTime) as firstTime 
| convert ctime(firstTime), ctime(lastTime)

This should do it!

If it helped can you accept the answer, please.

Re: How to search more than 1 year data

ivanreis — Tue, 22 Oct 2019 23:48:44 GMT

the age of data is defined as the retention police.
Check this additional link where you can have more information about it
-> https://answers.splunk.com/answers/553180/how-to-find-the-retention-period-of-an-index.html