Security

events time stamp is older than the index retention period ,how can we fix this.

rajneeshc1981
Explorer

events time stamp is older than the index retention period ,how can we fix this. ..please let me know.

Tags (1)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

A event only rolls over the retention period when all data in his bucket rolls over the retention period.
Check the volume of data you're indexing daily and the size of you buckets. By default a bucket is 750MB of size so if you indexing alot less than that daily, it might take some days to your bucket to roll.

try this to check the dates in your buckets

index=your_index
| eval bkt = _bkt 
| stats count min(_time) as min_time max(_time) as max_time by bkt | sort bkt
| convert ctime(*_time)
------------
Hope I was able to help you. If so, some karma would be appreciated.

rajneeshc1981
Explorer

how do I fix I see some events are older few days than indexed retention.

diogofgm
SplunkTrust
SplunkTrust

You reduce the size of your buckets close to what you are indexing daily using the maxDataSize parameter in your index stanza in indexes.conf
Check the docs here:
https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Indexesconf

------------
Hope I was able to help you. If so, some karma would be appreciated.

rajneeshc1981
Explorer

how to fix _time issues its not matching with index time for the events.
_time shows 2015 and index time shows current time.

0 Karma

somesoni2
Revered Legend

The _time is epoch representation of the timestamp found in raw data. The _indextime is when the event got index. If _time is extracted/evaluated from raw data, both will almost never be same (there will be at least some delay if _time is in past). If you want your _time to be same as _indextime you'd need to set your timestamp recognition to use current time. See this and read about DATETIME_CONFIG attribute that you can set for your sourcetype:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Configuretimestamprecognition#Timestamp_attri...

0 Karma

rajneeshc1981
Explorer

what is there is an issue with timestamp recognition or truncating ,how will I fix those type ?.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...