Getting Data In

Splunk DBConnect and retention

nithin204
Explorer

Hi All,

I am wondering how does the retention works when I am ingesting data which is older than the actual retention period.

For example, I have an index with a rention period of 1yr. I now have a requirement to ingest the data from the database which is older than 1.5yr to Splunk. What happens to the data when I onboard? Will it stay for another 1.5yr or will that become unsearchable soon after ingestion to Splunk.

Thanks in Advance.

0 Karma
1 Solution

sanjeev543
Communicator

Hi Nithin,

Data retention period on Splunk doesn't depends on how old your data in data sources. All it cares about how old is data once it got indexed.

So, in your case you should be able to search your 1.5 years old db data after it's indexed.

View solution in original post

0 Karma

sanjeev543
Communicator

Hi Nithin,

Data retention period on Splunk doesn't depends on how old your data in data sources. All it cares about how old is data once it got indexed.

So, in your case you should be able to search your 1.5 years old db data after it's indexed.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.