Data loss after a week for an Index in Splunk

[rchittip]

I have around 700 forwarders send the data to splunk and no index will keep data longer than 90 days.

My indexed data seems to be fine for last one week.
However, If i go for search before a week, number of returned data is significantly very low. I have been observing this issue from past one month. Data and number of returned hosts for a search is very very low before a week.

Can anyone suggests what is happening and why splunk is behaving like this.

Thanks,
Ramu Chittiprolu

[DalJeanis]

Your explanation is here...

https://docs.splunk.com/Documentation/Splunk/7.1.1/Indexer/HowSplunkstoresindexes

Pay special attention to the links at the bottom of the page.

Your system is configured to roll your data off to cold storage, probably after a certain amount of size. Check the machine to see how much of its storage it is using, and the average size of the buckets.

[renjith_nair]

Check other data retention parameters like maxTotalDataSizeMB