Getting Data In

Splunk DBConnect and retention

nithin204
Explorer

Hi All,

I am wondering how does the retention works when I am ingesting data which is older than the actual retention period.

For example, I have an index with a rention period of 1yr. I now have a requirement to ingest the data from the database which is older than 1.5yr to Splunk. What happens to the data when I onboard? Will it stay for another 1.5yr or will that become unsearchable soon after ingestion to Splunk.

Thanks in Advance.

0 Karma
1 Solution

sanjeev543
Communicator

Hi Nithin,

Data retention period on Splunk doesn't depends on how old your data in data sources. All it cares about how old is data once it got indexed.

So, in your case you should be able to search your 1.5 years old db data after it's indexed.

View solution in original post

0 Karma

sanjeev543
Communicator

Hi Nithin,

Data retention period on Splunk doesn't depends on how old your data in data sources. All it cares about how old is data once it got indexed.

So, in your case you should be able to search your 1.5 years old db data after it's indexed.

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...