Is there a way to audit who has modified the searchable retention period for the various indexes in Splunk cloud

Loves-to-Learn Everything

We found that the searchable events for our  wineventlog only goes back about 4 months but the searchable retention is set to 2 years 364 days (which is a total of 3 years). Splunk has said that the most likely scenario is that someone has changed the retention period recently.  We would like to find out who has modified the searchable retention period.

I have looked in the audit logs but that also only goes back about 5 months and have not found anything useful. I have also googled and have not found any solutions. Would appreciate any help. Thank you.

Labels (1)
0 Karma



another option is that you have lack of disk space and for that reason splunk has frozen those events before retention time has fulfil.

If you haven't have audit logs and haven't set any VCS into use there probably haven't any way to get this info. 

For future use you could check this:

As this is Splunk Cloud, have you bought additional disk capacity over standard 90 days?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...