Splunk Search

How long can a windows or unix host keep logs in the Splunk agent?

BryanCaballero
New Member

I will to make a back up of all the logs of splunk, so we want to be sure that all the host save the logs for a specific time, the windows will be around 28 hrs, more in specific the hosts of Windos and Unix servers

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @BryanCaballero,

if you're speaking of replication of Splunk Data between Indexers, you have to implement an Indexer Cluster,. for more infos see at https://docs.splunk.com/Documentation/Splunk/9.0.4/Indexer/Basicclusterarchitecture

If you're speaking of something else, please detail your requirements.

About Data Retention, you can configure it on Indexers (or on Master Node if you have an Indexer Cluster) following the instructions in my previous answer at https://community.splunk.com/t5/Getting-Data-In/Index-Retention-Time/m-p/641540#M109402

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...