Getting Data In

Splunk DBConnect and retention

Explorer

Hi All,

I am wondering how does the retention works when I am ingesting data which is older than the actual retention period.

For example, I have an index with a rention period of 1yr. I now have a requirement to ingest the data from the database which is older than 1.5yr to Splunk. What happens to the data when I onboard? Will it stay for another 1.5yr or will that become unsearchable soon after ingestion to Splunk.

Thanks in Advance.

0 Karma
1 Solution

Communicator

Hi Nithin,

Data retention period on Splunk doesn't depends on how old your data in data sources. All it cares about how old is data once it got indexed.

So, in your case you should be able to search your 1.5 years old db data after it's indexed.

View solution in original post

0 Karma

Communicator

Hi Nithin,

Data retention period on Splunk doesn't depends on how old your data in data sources. All it cares about how old is data once it got indexed.

So, in your case you should be able to search your 1.5 years old db data after it's indexed.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!