_audit index data retention in Splunk cluster

[pcsegal1]

Hi,

I have a Splunk cluster that consists of:
- 1 cluster master
- 3 indexers
- 1 search head

The indexes at the search head are configured to be forwarded to the indexers.

I would like to set a retention period shorter than the 6-year default to the _audit index in this Splunk cluster.

Normally, to deploy indexes to the indexers, the procedure I use is to create an app with an indexes.conf inside the cluster master's master-apps directory, then push the configuration. However, I'm unsure if this procedure would work for _audit.

How should I go about changing the retention period of the _audit index in all the indexers?

[gcusello · Accepted solution]

HI @pcsegal1,
for my experience, you could have two different approaches, both correct and efficient:

• you could have all the indexes in a dedicated TA (called e.g. TA_Indexers) located in %SPLUNK_HOME/etc/master-apps, that contains indexes.conf and eventually props.conf and transforms.conf of all your apps , then put in %SPLUNK_HOME/etc/master-apps/_cluster/local indexes.conf for internal indexes (as _audit); in this way you divide physically and concettually your configuration files on Indexers Cluster;
• in the above TA_Indexers, put all the conf files, both of internal and external indexes.

I prefer the first one, but also the second is correct.

In both cases, remember to add comments to each stanza.

Also the _audit index and the other internal indexes can be managed in this way.

Only one attention: choose the correct retention period related with your security policies and your regulation (e.g. in Italy audit logs must be archived at least for six months).

Ciao and Merry Christmas.
Giuseppe

[pcsegal1]

I applied your first approach (put in %SPLUNK_HOME/etc/master-apps/_cluster/local an indexes.conf file for the _audit index) and it worked as expected. Thank you and Merry Christmas.