Re: Retention Policy

sanjubaba · ‎03-12-2021

How to setup retention policies for indexes?

manjunathmeti · ‎03-12-2021

hi @sanjubaba,
Check this: https://docs.splunk.com/Documentation/Splunk/8.1.2/Indexer/Setaretirementandarchivingpolicy

jacobpevans · ‎03-12-2021

Greetings @sanjubaba,

See below for the two relevant pieces of documentation regarding setting index retention policies:

https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

Retention Policy

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Join the Conversation