Splunk DBConnect and retention

[nithin204]

Hi All,

I am wondering how does the retention works when I am ingesting data which is older than the actual retention period.

For example, I have an index with a rention period of 1yr. I now have a requirement to ingest the data from the database which is older than 1.5yr to Splunk. What happens to the data when I onboard? Will it stay for another 1.5yr or will that become unsearchable soon after ingestion to Splunk.

Thanks in Advance.

[sanjeev543 · Accepted solution]

Hi Nithin,

Data retention period on Splunk doesn't depends on how old your data in data sources. All it cares about how old is data once it got indexed.

So, in your case you should be able to search your 1.5 years old db data after it's indexed.