Splunk Search

How long can a windows or unix host keep logs in the Splunk agent?

New Member

I will to make a back up of all the logs of splunk, so we want to be sure that all the host save the logs for a specific time, the windows will be around 28 hrs, more in specific the hosts of Windos and Unix servers

Labels (2)
0 Karma

Esteemed Legend

Hi @BryanCaballero,

if you're speaking of replication of Splunk Data between Indexers, you have to implement an Indexer Cluster,. for more infos see at https://docs.splunk.com/Documentation/Splunk/9.0.4/Indexer/Basicclusterarchitecture

If you're speaking of something else, please detail your requirements.

About Data Retention, you can configure it on Indexers (or on Master Node if you have an Indexer Cluster) following the instructions in my previous answer at https://community.splunk.com/t5/Getting-Data-In/Index-Retention-Time/m-p/641540#M109402



0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...