Getting Data In

How to view Splunk data retention without access to indexes.conf?

wzgoda
Explorer

Hello-

I am auditing a company and am trying to determine the retention time for Splunk logs. I have been reading that you need access to the indexes.conf file, but I am unable to access it. Is there a command or somewhere else I can look in order to figure out the retention period?

Thanks

0 Karma
1 Solution

justinatpnnl
Communicator

You can use the rest api from a splunk search:

| rest /services/data/indexes

This should give you all of the configuration info you need.

http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTintrospect#data.2Findexes

View solution in original post

ddrillic
Ultra Champion

You can run this report which was published at bucket retention and frozenTimePeriodInSecs

The query is -

| dbinspect index=* | join index [|rest /services/data/indexes| eval index=title | table index frozenTimePeriodInSecs ] | eval toNow=now()-endEpoch | convert num(toNow) | convert num(frozenTimePeriodInSecs) | convert ctime(endEpoch) AS endEvent | convert ctime(startEpoch) AS startEvent | eval shouldBeFrozen=if( ( state!="hot" AND state!="thawed" ) AND toNow>frozenTimePeriodInSecs,"yes","no") | table index path id state startEvent endEvent shouldBeFrozen toNow frozenTimePeriodInSecs
0 Karma

christian_clout
Explorer

The Distribution Management Console also shows information about Data Retention if you are on 6.4.x.

0 Karma

SamHTexas
Builder

Where in Monitoring console do I find this info. please?

Tags (1)
0 Karma

justinatpnnl
Communicator

You can use the rest api from a splunk search:

| rest /services/data/indexes

This should give you all of the configuration info you need.

http://docs.splunk.com/Documentation/Splunk/6.4.1/RESTREF/RESTintrospect#data.2Findexes

wzgoda
Explorer

Thanks! this with a dedup on title helped me!

0 Karma

ppablo
Retired

Hi @wzgoda

Glad you found your answer through @justinatpnnl
I see you upvoted his answer, but please don't forget to actually resolve the post by clicking "Accept" directly below his answer.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try this:

  |dbinspect | convert ctime(endEpoch) | convert ctime(startEpoch) | table index, endEpoch, startEpoch, rawSize, sizeOnDiskMB, eventCount
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...