Monitoring Splunk

Audit index clean up

rranjan2020
New Member

Hello, I am trying to delete data from _audit index. Currently it contains last 6 years data and occupying lot of space. I modified the $SPLUNK_HOME/etc/system/default/indexes.conf and added below under _audit stanza:

 

 

[_audit]
FrozenTimePeriodInSecs = 3153600

 

 

I restarted the splunk after making the changes. But I still see older data under Audit. Can you please help in finding what is wrong here? Do I need to make any additional changes or invoke anything to reflect the changes?

Thanks in advance for your help.

Labels (3)
0 Karma

saravanan90
Contributor

It might be configured in some other apps. Please check the value through btool.

./splunk btool indexes list _audit --debug | grep frozenTimePeriodInSecs

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...