overwite of logging data - Splunk Community

Getting Data In

Hi all

How/where do I set inside splunk so that the logging data(ie syslog data) can be overwrite in X number of months?

Anyone can advise? Thank in advance.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Indexer/Setaretirementandarchivingpolicy

Or automatically delete away logging data in past X number of months also can.

Please help. Thanks.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...