Getting Data In

Old log getting stored as .csv format even before retention?

anil28
New Member

Hi Team,

We have defined the index retention as 420 days but when we are trying to access the logs those are in .csv format not as event-value format.

PFA of index details and below indexes.conf confuguration if that index.

 

[rt_efb]
# 250MB a day / 35 days in warm / 460 days retention / 8 GB max index size
homePath = volume:hot/rt_efb/db
coldPath = volume:cold/rt_efb/colddb
thawedPath = $SPLUNK_DB/rt_efb/thaweddb
#set to 5 days, +- 5days padding
maxHotSpanSecs = 432000
#set to 2 hot buckets
maxHotBuckets = 2
homePath.maxDataSizeMB = 2500
coldPath.maxDataSizeMB = 5500
frozenTimePeriodInSecs = 39744000
maxTotalDataSizeMB = 26000

 

Can you please suggest us on this?

 

Regards,

Anil

 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

What you are meaning with "those are in .csv format"?

As you are using volumes (it's best practices) there are also those volume sizing parameters which could also affect what you really have on disk.

btw. you cannot define how long events are in warm. There is no that kind of parameter. Only things what you can do is define how many buckets can be on warm state and how much space they have. Of course also max volume is one constraint for all indexes in that volume.

As there are already quite many answers about this issue, You could look those e.g. with google like "site:community.splunk.com splunk event retention parameters" or something similar.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...