Can you let me know what is the retention period for the data stored in the splunk.
How long the indexed data will remain in the SPLUNK?
Thanks & Regards,
Its a configurable value. There are many questions in splunkbase on similar lines (see the 'related questions' on right of this page). Documentation link: http://docs.splunk.com/Documentation/Splunk/6.1.1/Indexer/Setaretirementandarchivingpolicy
View solution in original post