Splunk indexing retention policy

[SS1]

hello Splunkers,

We have a index whose retention pol;icy is varying for the applications that are reporting to that index. For example, Application 1 we can see the logs from August and for application 2 we can see the logs from September, both applications are reporting to same index. I know we can set the retention policy per index. Is there any setting that we are missing here?

[SS1]

by app i meant a java application not the splunk app

[SS1]

Does both application get archived in different buckets? and the retention policy apply differently to different buckets?

[SS1]

Hi,

Both the applications are indexing into only 1 index, they don't index to any other indexer. and we dont use seperate index.conf for applications

[richgalloway]

Different apps can set the various values for each index however they choose.  Those settings are merged with the final value dependent on the names of the defining apps.  That's why it's important for the Splunk admin to reconcile each app's settings to something that makes sense for the local environment.  Apps are discouraged from shipping an indexes.conf file that contains enabled indexes for the same reason.

That said, if both indexes are truly writing to the same index then they should be seeing the same data.  That they are not seeing the same data tells me something is different between the apps.  Use btool to see if you can identify the difference(s).

splunk btool --debug indexes list -app=Application1 > app1.txt
splunk btool --debug indexes list -app=Application2 > app2.txt
diff app1.txt app2.txt