I need to learn the data Retention settings for Splunk Ent. & ES in my environment. Would you share a SPL if there are any please. Thanks a million.
Try something like this:
| rest splunk_server=<yourIndexer> /services/data/indexes
| join type=outer title [
| rest splunk_server=<yourIndexer> /services/data/indexes-extended
]
| eval retentionInDays=frozenTimePeriodInSecs/86400
| table title retentionInDays