topic Re: How can I find the data retention and indexers involved? in Splunk Search

How can I find the data retention and indexers involved?

danielbb — Thu, 01 Jun 2023 13:26:27 GMT

I need a query that will provide the earliest date for data within an index as well as the indexer it is stored on, specifically looking for which indexes are storing data for one year or more and on which indexers they are being stored on.

Any ideas?

Re: How can I find the data retention and indexers involved?

isoutamo — Thu, 01 Jun 2023 13:43:52 GMT

You probably have MC installed, configured and in use in your environment? If not then you should take it into use!

You can see (almost) this from MC -> Indexing -> Indexes and Volumes: Deployment.

If that report is not exactly what you are looking for you could open it's search (by right hand side lower corner) and update that search to fulfil your needs.

r. Ismo

Re: How can I find the data retention and indexers involved?

SinghK — Thu, 01 Jun 2023 13:55:51 GMT

Data retention can also be checked from indexes.conf thuogh you will have to convert time.

Re: How can I find the data retention and indexers involved?

isoutamo — Thu, 01 Jun 2023 14:12:31 GMT

That told what has defined, but it didn't told you what is current situation on your environment. There could be e.g. too less space for fulfil those definitions and/or some events could be there much longer as buckets contains newer events etc.

Here is some older post which explain this behabiour