Retention period in GUI?

[eroemisch]

Hello,
I am novice at best when it comes to Splunk administration. Running Splunk Enterprise through AWS on a Linux instance, I have one Windows box forwarding over logs. I need to set a retention period of 30 days for the logs then I want them to be deleted.

I keep seeing that this setting would be in indexes.conf, but I am not sure how to access that, can this be done through a GUI or do I have to use the CLI?

[gcusello · Accepted solution]

Hi,
with the current version, you can display retention period using Distributed Monitoring Console, but to set a retention period you can only access the Splunk indexer by CLI and modify indexes.conf.

Bye.
Giuseppe

[SamHTexas]

Grazie, how do I view this info using Monitoring console with Splunk 8.0 & above?

[eroemisch]

Great, thanks for the answer. Is there a default location I should be looking for the indexes.conf? I assume there is a master file that I can set, and if I need to set different times for different servers I can point them to a different conf file?

[gcusello]

Hi eroemisch ,
it depends by your indexes.conf files: you can insert them in each app or create an app dedicated to indexes.
The importanto thing (for me) it's to choose a method and follow it in every app.
I'd avoid to put them in launcher or search apps (usually it happens!) and remeber to put your indexes.conf in local folders and not in default folders.

Bye.
Giuseppe

P.S.: if you're satisfied by this answer, please accept it.