Splunk Search

How to extend Splunk log retention to forever?

csahoo
Explorer

We have a  service for which we have splunk dashboard is in place and right now the dashboard have the limitation that it can populate based on 3 month old data due to log retention policy , but right now there is a business requirement that the dashboard should populate based on forever data.

so here i want to understand what can be efficient and economical way to extend the log retention to forever in Splunk.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @csahoo,

for my expertience there isn't any requirement from regulations or logic to have a forever retention on your logs!

You should understand if there are regulations requirements that usually are the drivers in retention policies: e.g. in Italy there's a regulation that requires 6 months or retention for system access logs.

About the logs not under a regulation, you could maintain that for three, six or twelve months, more I think that it's completely unuseful.

Eventually, you could maintain some statistics for two or three years, but not full logs.

The reason of this is obviously that logs maintaining requires storage and it cost, especially if you have a great daily volume.

I hope to be useful in my dissertation on maximum systems, at the end, try to have the less quantity of logs as possible  to maintain.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...