Issue : In the _internal logs we have logs from all Splunk UF and Splunk Enterprise components. The _internal logs from Splunk UF we do not want for more than 15 days. But _internal logs from Splunk Enterprise components such as CM/LM/MC, IDX, SH, SHC, DS, HF we want to store for longer duration for analysis purpose.
Now if we send _internal logs of Splunk enterprise component to different index then a lot of out-of-box searches in MC will not run as it should be. Even the inbuilt license query will be effected.
We have tried using mcollect to send the _internal logs to another index but then sourcetype is changed to Stash.
Please let me know if there is a way to do it??
Hi @ayush-choudhary,
it's not so clear for me why you want a different retention period for data of other machines.
Anyway, I didn't tested, but it should run: you could export _raw data in a summary index, running a simple search:
index=_internal host IN (CM_hostname, IDX_hostname, SH_hostname, SHCv, DS_hostname, HF_hostname)
| collect index=summary_internal
Ciao.
Giuseppe