Data Retention and events from imported files

[santorof]

I recently imported a few events from a csv into Splunk. These events were from 2014. Our data retention policy was configured for 180 days. Does the data go cold 180 days from the current date or from when the events were indexed? I cant seem to find the events that were imported a few days ago.

[somesoni2 · Accepted solution]

The retention period of the data is based on the timestamp of the data in a bucket. The bucket names are in format db___* . A bucket is rolled over to frozen when the epochtimeoftheoldestevent is older than your data retention period (180 day in your case) from current time. See more details on how data retention works here.

https://wiki.splunk.com/Deploy:BucketRotationAndRetention

[santorof]

I read the document but whats not clear is if the time stamp is created when the event hits the bucket or is extracted from the event. This would help me in determining if the data that I ingested was rolled over into frozen from my policy or something else entirely

[somesoni2]

The timestamp of the event is depending upon the sourcetype/source/host definition that you define on your Indexer/Heavy forwarder (props.conf). You should check that to identify if the Splunk will take the timestamp from the event data itself OR use the current timestamp.

[santorof]

Appreciate it thank you. I will take a look.