Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Index Data Retention
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Query to check what is the Data retention set for hot/warm , cold for each index
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The only duration Splunk uses for data management is the frozen period - ie how long does data remain searchable in Splunk before it is archived or deleted.
The amount of "time" data stays in hot/warm is based on either size, or the number of buckets (not duration)
See the following for info on how to query for frozen durations:
https://answers.splunk.com/answers/476377/how-to-search-and-table-the-retention-time-of-each.html
The best place to check for your index settings is your index definitions.
- on a stand alone indexer, check the indexes.conf on the indexer (you may have to look in multiple apps) $SPLUNK_HOME/etc/apps/appname/[local|default]/indexes.conf
- on an indexer cluster, check the indexes.confs on the cluster master in $SPLUNK_HOME/etc/master-apps/[_cluster|yourapp]/[default|local]/indexes.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The only duration Splunk uses for data management is the frozen period - ie how long does data remain searchable in Splunk before it is archived or deleted.
The amount of "time" data stays in hot/warm is based on either size, or the number of buckets (not duration)
See the following for info on how to query for frozen durations:
https://answers.splunk.com/answers/476377/how-to-search-and-table-the-retention-time-of-each.html
The best place to check for your index settings is your index definitions.
- on a stand alone indexer, check the indexes.conf on the indexer (you may have to look in multiple apps) $SPLUNK_HOME/etc/apps/appname/[local|default]/indexes.conf
- on an indexer cluster, check the indexes.confs on the cluster master in $SPLUNK_HOME/etc/master-apps/[_cluster|yourapp]/[default|local]/indexes.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If my answer helped, please consider accepting and/or upvoting so that other memebers of the community can see it was useful.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Accepted it on the poster's behalf. Cheers!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26
Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM
Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas
