Splunk Enterprise

Is there an SPL to show the Splunk Ent + ES Data Retention settings. Thanks a mil.


I need to learn the data Retention settings for Splunk Ent. & ES in my environment. Would you share a SPL if there are any please. Thanks a million.

Labels (1)
Tags (1)
0 Karma

Revered Legend

Try something like this:

| rest splunk_server=<yourIndexer> /services/data/indexes
   | join type=outer title [
     | rest splunk_server=<yourIndexer> /services/data/indexes-extended
|  eval retentionInDays=frozenTimePeriodInSecs/86400
| table title retentionInDays


0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...