Other Admin

search results only for 3 months

Gaya3_devi
Explorer

Hi Splunkers,
i have been working on a dashboard for that I need the data for last 7 months from jan 2024 to till date when i was searching for the logs it was only showing for the last 3 months data i.e., from 10, jun to till date and gradually all the logs are disappearing is there any way to fix this...
i tried this query 

| tstats earliest(_time) as first, latest(_time) as last where index=foo | fieldformat first=strftime(first,"%c") | fieldformat last=strftime(last,"%c")

the result shows
index="my-index" 
               first                                                       last 

Mon Jun 10 04:19:23 2024     Tue Aug 27 07:50:04 2024

Gaya3_devi_0-1724745391447.png

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's natural that old data is getting rolled out of your index when you're either reaching retention limits or your index (or whole volume) hits size limits. So check your index and volume parameters and your index size usage.

0 Karma

Gaya3_devi
Explorer

how to check index and volume parameters and index size

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Depends on your environment. If you have an all-in-one installation, the easiest method would be to go to settings->indexes

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...