Splunk Periodic Cleanup Activities

[tk111]

With Splunk for Windows and Splunk Enterprise Security. Are there specific periodic maintenance tasks that need to be done? For example every few months a cache needs to be cleared?

[gcusello]

Hi @tk111,

there isn't any periodic maintenence needed in Splunk.

The only needed maintenence are to:

• upgrade Splunk when there are new releases;
• intervene when there's some problem (e.g. data integrity checks).

Data retention is automatically managed by Splunk.

Obviously you need to back-up your data and configurations!

Ciao.

Giuseppe

[tk111]

Thanks @gcusello  that is helpful. 

Do data integrity checks need to be performed periodically?

I'm assuming we'd be able to perform them following this:

https://docs.splunk.com/Documentation/Splunk/8.2.0/Security/Dataintegritycontrol

[gcusello]

Hi @tk111,

if you enable Integrity Check on all your indexes, you don't need to plan it because Splunk automatically does it.

If this answer solves your need, please accept it for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉