Getting Data In

_audit index data retention in Splunk cluster

pcsegal1
Explorer

Hi,

I have a Splunk cluster that consists of:
- 1 cluster master
- 3 indexers
- 1 search head

The indexes at the search head are configured to be forwarded to the indexers.

I would like to set a retention period shorter than the 6-year default to the _audit index in this Splunk cluster.

Normally, to deploy indexes to the indexers, the procedure I use is to create an app with an indexes.conf inside the cluster master's master-apps directory, then push the configuration. However, I'm unsure if this procedure would work for _audit.

How should I go about changing the retention period of the _audit index in all the indexers?

0 Karma
1 Solution

gcusello
Legend

HI @pcsegal1,
for my experience, you could have two different approaches, both correct and efficient:

  • you could have all the indexes in a dedicated TA (called e.g. TA_Indexers) located in %SPLUNK_HOME/etc/master-apps, that contains indexes.conf and eventually props.conf and transforms.conf of all your apps , then put in %SPLUNK_HOME/etc/master-apps/_cluster/local indexes.conf for internal indexes (as _audit); in this way you divide physically and concettually your configuration files on Indexers Cluster;
  • in the above TA_Indexers, put all the conf files, both of internal and external indexes.

I prefer the first one, but also the second is correct.

In both cases, remember to add comments to each stanza.

Also the _audit index and the other internal indexes can be managed in this way.

Only one attention: choose the correct retention period related with your security policies and your regulation (e.g. in Italy audit logs must be archived at least for six months).

Ciao and Merry Christmas.
Giuseppe

View solution in original post

gcusello
Legend

HI @pcsegal1,
for my experience, you could have two different approaches, both correct and efficient:

  • you could have all the indexes in a dedicated TA (called e.g. TA_Indexers) located in %SPLUNK_HOME/etc/master-apps, that contains indexes.conf and eventually props.conf and transforms.conf of all your apps , then put in %SPLUNK_HOME/etc/master-apps/_cluster/local indexes.conf for internal indexes (as _audit); in this way you divide physically and concettually your configuration files on Indexers Cluster;
  • in the above TA_Indexers, put all the conf files, both of internal and external indexes.

I prefer the first one, but also the second is correct.

In both cases, remember to add comments to each stanza.

Also the _audit index and the other internal indexes can be managed in this way.

Only one attention: choose the correct retention period related with your security policies and your regulation (e.g. in Italy audit logs must be archived at least for six months).

Ciao and Merry Christmas.
Giuseppe

pcsegal1
Explorer

I applied your first approach (put in %SPLUNK_HOME/etc/master-apps/_cluster/local an indexes.conf file for the _audit index) and it worked as expected. Thank you and Merry Christmas.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...