Getting Data In
Highlighted

How can I increase how far back users can see data in splunk?

New Member

When I run a search for "All Time" it looks to stop displaying data beyond 90 days into the past. Where's the config file(s) I need to change to increase how far back users can view indexed data?

Tags (1)
0 Karma
Highlighted

Re: How can I increase how far back users can see data in splunk?

SplunkTrust
SplunkTrust

I believe the data available in your index that you're search is only 90 days. This is set by the retention period policy that you/your Splunk admin has applied. See below link on how the data retention policy is applied on Splunk. Based on this, setup appropriate data retention policy

http://wiki.splunk.com/Deploy:BucketRotationAndRetention
http://docs.splunk.com/Documentation/Splunk/6.2.5/Indexer/Setaretirementandarchivingpolicy