https://community.splunk.com/t5/Splunk-Search/How-to-get-the-data-of-indexers-which-is-having-more-than-45/m-p/586503#M204296 <P><SPAN>Hello!<BR /></SPAN></P> <P><SPAN>My name is Yeasuh and I am a Community Content Specialist for Splunk Answers. Thank you for participating in the Splunk Answers community. </SPAN><SPAN>To increase your chances of getting help from the community, please make sure you are descriptive and explain the question with enough detail (providing sanitized data etc).</SPAN></P> <P>Thank you and Happy Splunking!</P> Thu, 24 Feb 2022 22:20:58 GMT yeasuh 2022-02-24T22:20:58Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-data-of-indexers-which-is-having-more-than-45/m-p/586488#M204294 <P>can i get the data of indexers which is having more than 45 days old data.</P> Thu, 24 Feb 2022 22:18:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-data-of-indexers-which-is-having-more-than-45/m-p/586488#M204294 rajureddi121195 2022-02-24T22:18:50Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-data-of-indexers-which-is-having-more-than-45/m-p/586503#M204296 <P><SPAN>Hello!<BR /></SPAN></P> <P><SPAN>My name is Yeasuh and I am a Community Content Specialist for Splunk Answers. Thank you for participating in the Splunk Answers community. </SPAN><SPAN>To increase your chances of getting help from the community, please make sure you are descriptive and explain the question with enough detail (providing sanitized data etc).</SPAN></P> <P>Thank you and Happy Splunking!</P> Thu, 24 Feb 2022 22:20:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-data-of-indexers-which-is-having-more-than-45/m-p/586503#M204296 yeasuh 2022-02-24T22:20:58Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-data-of-indexers-which-is-having-more-than-45/m-p/586540#M204305 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/243377">@rajureddi121195</a>,</P><P>as&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/224993">@yeasuh</a>&nbsp;said, if you could share more infos, we'd be able to help you better and quicker!</P><P>Anyway, you can search all the events that are in Hot, Warm and Cold Buckets, in other words the events that don't exceed the retention period.</P><P>So, if the retention period of your index is more than 45 days you can search events in that index.</P><P>You can check the retention period of you indexes using the Monitoring Console.</P><P>Ciao.</P><P>Giuseppe</P> Fri, 25 Feb 2022 06:40:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-data-of-indexers-which-is-having-more-than-45/m-p/586540#M204305 gcusello 2022-02-25T06:40:54Z