Getting Data In

Why are Unix sourcetypes unsearchable in Splunk beyond past two months

zijian
Explorer

Hi all,

I found that searches in my unix index returns events only up to the past two months for a significant number of sourcetypes (bash_history, audit, secure, sudo logs).

Shouldn't the events be retained according to the retention period set using 'frozenTimePeriodInSecs'?

We set the period to 365 days.

 

Regards,

Zijian

 

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zijian,

if you have logs of arounf two months ago but you don't have logs ot today, probably means that you had a problem that blocked the log ingestions.

The retention is satisfied because you have logs of two months ago that aren't outside the retention period.

So I hint to check the log ingestions.

If instead the problem is that you haven't logs older than 2 months, I hint to see if there are more retention definitions for that index that override the correct one.

You can do this using btool (https://docs.splunk.com/Documentation/Splunk/9.0.0/Troubleshooting/Usebtooltotroubleshootconfigurati...).

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...