Data Age in splunk

[vumanhtai]

Hi Splunk Team!

Why my index paloalto, panorama only hold 23 days and 14 days like the image below

My index cluster configuration is as follows

How do i fix it?

Has my current data for 1 year been deleted?

Thanks!

[richgalloway · Accepted solution]

Those indexes have reached their maximum sizes. To continue to accept new data, old data is removed (deleted). To fix it, increase the maximum size of the index (maxTotalDataSizeMB).