Getting Data In

How to view Splunk data retention without access to indexes.conf?

wzgoda
Explorer

Hello-

I am auditing a company and am trying to determine the retention time for Splunk logs. I have been reading that you need access to the indexes.conf file, but I am unable to access it. Is there a command or somewhere else I can look in order to figure out the retention period?

Thanks

0 Karma
1 Solution

justinatpnnl
Communicator

You can use the rest api from a splunk search:

| rest /services/data/indexes

This should give you all of the configuration info you need.

http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTintrospect#data.2Findexes

View solution in original post

ddrillic
Ultra Champion

You can run this report which was published at bucket retention and frozenTimePeriodInSecs

The query is -

| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs
0 Karma

christian_clout
Explorer

The Distribution Management Console also shows information about Data Retention if you are on 6.4.x.

0 Karma

SamHTexas
Builder

Where in Monitoring console do I find this info. please?

Tags (1)
0 Karma

justinatpnnl
Communicator

You can use the rest api from a splunk search:

| rest /services/data/indexes

This should give you all of the configuration info you need.

http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTintrospect#data.2Findexes

wzgoda
Explorer

Thanks! this with a dedup on title helped me!

0 Karma

ppablo
Retired

Hi @wzgoda

Glad you found your answer through @justinatpnnl
I see you upvoted his answer, but please don't forget to actually resolve the post by clicking "Accept" directly below his answer.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try this:

  |dbinspect | convert ctime(endEpoch) | convert ctime(startEpoch) | table index, endEpoch, startEpoch, rawSize, sizeOnDiskMB, eventCount
0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...