Splunk Search

How to extend Splunk log retention to forever?

csahoo
Explorer

We have a  service for which we have splunk dashboard is in place and right now the dashboard have the limitation that it can populate based on 3 month old data due to log retention policy , but right now there is a business requirement that the dashboard should populate based on forever data.

so here i want to understand what can be efficient and economical way to extend the log retention to forever in Splunk.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @csahoo,

for my expertience there isn't any requirement from regulations or logic to have a forever retention on your logs!

You should understand if there are regulations requirements that usually are the drivers in retention policies: e.g. in Italy there's a regulation that requires 6 months or retention for system access logs.

About the logs not under a regulation, you could maintain that for three, six or twelve months, more I think that it's completely unuseful.

Eventually, you could maintain some statistics for two or three years, but not full logs.

The reason of this is obviously that logs maintaining requires storage and it cost, especially if you have a great daily volume.

I hope to be useful in my dissertation on maximum systems, at the end, try to have the less quantity of logs as possible  to maintain.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...