Hi All,
Good day...
I have a situation here..
The logs of a particular source-type in a index is getting disappeared.
For ex.. Please find the below results for a query
2021-07-20 0
2021-07-21 10
2021-07-22 232
2021-07-23 3571
After some time like or 24 hrs if I try to run the same search I am getting the below results.
2021-07-20 0
2021-07-21 0
2021-07-22 2
2021-07-23 1524
the logs are being disappeared for the older days.
Note the index max size is set to unlimited and there are no issues with the other source-types under the same source.
Could you please check and let me know what is the issue here..
@kamlesh_vaghela
Thank you very much for the quick response and Sorry for the delay to your response..
The frozenTimePeriodInSecs is configured as 31536000(365 days)..
Can you please verify the frozenTimePeriodInSecs in indexes.conf for that index?
https://docs.splunk.com/Documentation/Splunk/8.2.1/Admin/Indexesconf
https://wiki.splunk.com/Deploy:BucketRotationAndRetention
KV