Is there a way to audit who has modified the searchable retention period for the various indexes in Splunk cloud

Loves-to-Learn Everything

We found that the searchable events for our  wineventlog only goes back about 4 months but the searchable retention is set to 2 years 364 days (which is a total of 3 years). Splunk has said that the most likely scenario is that someone has changed the retention period recently.  We would like to find out who has modified the searchable retention period.

I have looked in the audit logs but that also only goes back about 5 months and have not found anything useful. I have also googled and have not found any solutions. Would appreciate any help. Thank you.

Labels (1)
0 Karma



another option is that you have lack of disk space and for that reason splunk has frozen those events before retention time has fulfil.

If you haven't have audit logs and haven't set any VCS into use there probably haven't any way to get this info. 

For future use you could check this:

As this is Splunk Cloud, have you bought additional disk capacity over standard 90 days?

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...