Archive

Indexed counts dropping

Explorer

I appear to be de-indexing data because my global count sometimes goes down and certain count queries drop. I assume there is data expiry settings somewhere but I'm not sure where to look.

Tags (1)
0 Karma

Super Champion

Read this document. It will explain the settings. You can select your Splunk version in the upper right:

http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy

0 Karma