Where and how can I set the data retention on Splunk?
Because I have seen there are many bow to set it like telemetry, main etc.. So it's really not clear...
Here's a doc topic for you: Set a retirement and archiving policy in the Managing Indexers and Clusters of Indexers manual. Also see Archive indexed data.
