Reporting

A 90day Accelerated Report only shows 10 days of data

tpaulsen
Contributor

Hi, i created a search, to get an overview of the license volume usage in our Splunk system.

index="_internal" source="*metrics.log" per_sourcetype_thruput | eval GBytes=((kb/1024)/1024) | timechart span=1d sum(GBytes) as GBytes by series

The search is being accelerated and should give me data for 90 days. A dashboard that is based on this, only shows 10 days of data. What are we doing wrong? We have a similar sitation with other data and accelerated searches. Data is only viewable for the last 7 - 10 days and than no data.

Thank you, Thomas

Tags (1)
0 Karma

tpaulsen
Contributor

90 days for the accelerated summary.

0 Karma

jdunlea_splunk
Splunk Employee
Splunk Employee

I think the default retention period for the internal index is 28 days, so without changing that you will not be able to see 90 days of data. I am not sure why you are only seeing 10 days of data - Was this setting lowered by any chance? Do you have access to the CLI? If so, you can run the following command and from the output, check the "frozenTimePeriodInSecs" setting for the [_internal] stanza to see how long you are keeping internal data. (Or you can also check the indexes page in the manager to see what the "earliest event" you have in that index is, to see if there is indeed any data past 10 days ago)

(assuming Splunk is installed in /opt/splunk...)

Command: /opt/splunk/bin/splunk cmd btool indexes list --debug

Also, remember that the report accelerated data will not live longer than the original rawdata, regardless of the report accelerated window setting.

jonuwz
Influencer

whats your summary range set to in the saved search ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...