How to get the data of indexers which is having more than 45 days old data?

[rajureddi121195]

can i get the data of indexers which is having more than 45 days old data.

[gcusello]

Hi @rajureddi121195,

as @yeasuh said, if you could share more infos, we'd be able to help you better and quicker!

Anyway, you can search all the events that are in Hot, Warm and Cold Buckets, in other words the events that don't exceed the retention period.

So, if the retention period of your index is more than 45 days you can search events in that index.

You can check the retention period of you indexes using the Monitoring Console.

Ciao.

Giuseppe

[yeasuh]

Hello!

My name is Yeasuh and I am a Community Content Specialist for Splunk Answers. Thank you for participating in the Splunk Answers community. To increase your chances of getting help from the community, please make sure you are descriptive and explain the question with enough detail (providing sanitized data etc).

Thank you and Happy Splunking!