Splunk Search

What is the Default bucketing time and retention policy?

splunkcol
Builder

Hello to all

I would like to know the default time set for hot, warm, cold and frozen buckets. I also want to know what the retention policy is.

When I go to "Settings" -> "Monitoring Console" -> "Indexing" -> "Indexes and Volumes" -> "Index Detail: Instance"

I find the following retention policy

splunkcol_1-1677705343091.png

When I enter the path $SPLUNK_HOME/etc/system/local/default/web.conf I can see some information about the buckets

splunkcol_2-1677705503402.png

thanks if someone can solve my question

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...

Thank You for Celebrating CX Day with Splunk!

Yesterday the entire team at Splunk + Cisco joined the global celebration of CX Day - celebrating our ...