Default setting for splunk log retention

[yuwtennis]

Hi!

I see that splunk manages its logs with log.cfg

However, not all the logs are listed in this configuration file.(web_service.log, web_access.log,btool.log,etc)
Is it correct to understand, the default setting for maxBackupIndex and maxFileSize
as following?

maxBackupIndex = 5
maxFileSize = 25MB

Thanks,
Yu

[kristian_kolb · Accepted solution]

Well, that's for the files on disk, but they are also indexed by Splunk, and are found in the _internal index, where they are retained for (default) 30 days.

/K

[yuwtennis]

hello kristian.

Thank you for the reply.

Yes . I wanted to know the retention policy for the files.

Thanks,
Yu