topic Re: how to know the current retention policy in Splunk Search

how to know the current retention policy

kteng2024 — Thu, 06 Apr 2017 21:04:43 GMT

Hi,

Is there anyway to know the current retention policy we have in splunk environment for all the indexes ?

Re: how to know the current retention policy

skoelpin — Thu, 06 Apr 2017 21:24:37 GMT

Yes, go to Settings>Indexes

Look at the max size of all the indexes. The max index size defaults to 500GB or 6 years

Here's a good doc explaining how the index retention works

https://wiki.splunk.com/Deploy:BucketRotationAndRetention

Re: how to know the current retention policy

gcusello — Fri, 07 Apr 2017 07:50:38 GMT

Hi kteng2024,
you can use Distributed Monitoring Console at [Indexing -- Indexes and Volumes -- Index Details - Instance], in the center of the dashboard there is a panel called "Retention policies" in which you can find all index retention information.
Bye.
Giuseppe