Splunk Enterprise

Why is Splunk not retaining logs beyond 90 days?

SinghK
Builder

hi All,

Though i have set frozenTimePeriodInSecs to a year on a cluster, the logs are only getting retained till 90 days max

same settings in other cluster is working fine. need some help checking the issue.

thanks in advance,

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

First thing to check - size limit. The buckets are getting frozen when either

1) The earliest event in the bucket is oldest than the bucket age limit or

2) The data reaches maxTotalDataSizeMB limit

So even if your data is not old enough but you have enough  data to fill your index to the limit, your oldest buckets will get frozen/discarded.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

First thing to check - size limit. The buckets are getting frozen when either

1) The earliest event in the bucket is oldest than the bucket age limit or

2) The data reaches maxTotalDataSizeMB limit

So even if your data is not old enough but you have enough  data to fill your index to the limit, your oldest buckets will get frozen/discarded.

SinghK
Builder

In my case it was maxvolumedatasizemb

 

0 Karma

SinghK
Builder

thanks @PickleRick , I will check that ..

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...