Splunk Search
Highlighted

how to know the current retention policy

Path Finder

Hi,

Is there anyway to know the current retention policy we have in splunk environment for all the indexes ?

0 Karma
Highlighted

Re: how to know the current retention policy

SplunkTrust
SplunkTrust

Yes, go to Settings>Indexes

Look at the max size of all the indexes. The max index size defaults to 500GB or 6 years

Here's a good doc explaining how the index retention works

https://wiki.splunk.com/Deploy:BucketRotationAndRetention

Highlighted

Re: how to know the current retention policy

Legend

Hi kteng2024,
you can use Distributed Monitoring Console at [Indexing -- Indexes and Volumes -- Index Details - Instance], in the center of the dashboard there is a panel called "Retention policies" in which you can find all index retention information.
Bye.
Giuseppe