Where can I see the retention policy of the indexes in Splunk Web?

[ddrillic]

I can see the retention policy of the indexes in /opt/splunk/etc/master-apps/_cluster/local/indexes.confin frozenTimePeriodInSecs. I wonder where I can see in Splunk Web? We need a nice screenshot of that for auditing ...

[rjthibod · Accepted solution]

I am pretty sure it is not visible in any ui, but you can run a search to get the value and format it accordingly.

Here is the search:

| rest /services/data/indexes | fields title froz* | rename title as index

[wrangler2x]

I noticed that some of the indexes (such as _fishbucket) were in the list more than once, so I used deadup to drop the dupes. I also tossed in days and a row number:

| rest /services/data/indexes 
| rename title as index | dedup index | sort index
| streamstats count as Row
| eval Days=frozenTimePeriodInSecs/86400
| fields Row index frozenTimePeriodInSecs Days

[ddrillic]

Gorgeous - thank you both.