Getting Data In

_audit index data retention in Splunk cluster

pcsegal1
Explorer

Hi,

I have a Splunk cluster that consists of:
- 1 cluster master
- 3 indexers
- 1 search head

The indexes at the search head are configured to be forwarded to the indexers.

I would like to set a retention period shorter than the 6-year default to the _audit index in this Splunk cluster.

Normally, to deploy indexes to the indexers, the procedure I use is to create an app with an indexes.conf inside the cluster master's master-apps directory, then push the configuration. However, I'm unsure if this procedure would work for _audit.

How should I go about changing the retention period of the _audit index in all the indexers?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

HI @pcsegal1,
for my experience, you could have two different approaches, both correct and efficient:

  • you could have all the indexes in a dedicated TA (called e.g. TA_Indexers) located in %SPLUNK_HOME/etc/master-apps, that contains indexes.conf and eventually props.conf and transforms.conf of all your apps , then put in %SPLUNK_HOME/etc/master-apps/_cluster/local indexes.conf for internal indexes (as _audit); in this way you divide physically and concettually your configuration files on Indexers Cluster;
  • in the above TA_Indexers, put all the conf files, both of internal and external indexes.

I prefer the first one, but also the second is correct.

In both cases, remember to add comments to each stanza.

Also the _audit index and the other internal indexes can be managed in this way.

Only one attention: choose the correct retention period related with your security policies and your regulation (e.g. in Italy audit logs must be archived at least for six months).

Ciao and Merry Christmas.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

HI @pcsegal1,
for my experience, you could have two different approaches, both correct and efficient:

  • you could have all the indexes in a dedicated TA (called e.g. TA_Indexers) located in %SPLUNK_HOME/etc/master-apps, that contains indexes.conf and eventually props.conf and transforms.conf of all your apps , then put in %SPLUNK_HOME/etc/master-apps/_cluster/local indexes.conf for internal indexes (as _audit); in this way you divide physically and concettually your configuration files on Indexers Cluster;
  • in the above TA_Indexers, put all the conf files, both of internal and external indexes.

I prefer the first one, but also the second is correct.

In both cases, remember to add comments to each stanza.

Also the _audit index and the other internal indexes can be managed in this way.

Only one attention: choose the correct retention period related with your security policies and your regulation (e.g. in Italy audit logs must be archived at least for six months).

Ciao and Merry Christmas.
Giuseppe

pcsegal1
Explorer

I applied your first approach (put in %SPLUNK_HOME/etc/master-apps/_cluster/local an indexes.conf file for the _audit index) and it worked as expected. Thank you and Merry Christmas.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...