I appear to be de-indexing data because my global count sometimes goes down and certain count queries drop. I assume there is data expiry settings somewhere but I'm not sure where to look.
Read this document. It will explain the settings. You can select your Splunk version in the upper right:
http://docs.splunk.com/Documentation/Splunk/6.0/Indexer/Setaretirementandarchivingpolicy
