Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
15 results
Sorted by:
11-23-2011
12:48 AM
...onitor input stanza.
Without crcSalt Indexer is not reading this file.
We have set retirement and archiving policy as 3 months for all splunk data. So after 3 months will splunk automatically read t...
- Tags:
- archiving
- retirement
05-19-2020
04:48 PM
...oldtofrozendir = $SPLUNK_DB/defaultdb/frozendb frozentimeperiodinsecs = 1209600
According to the "Set a retirement and archiving policy" and "indexes.conf" documentation on splunk docs, the settings i...
Labels
- Labels:
-
other
09-26-2018
04:29 AM
...o convert the days to minutes value and then use that in abucket configuration. But I didn't find any proper example in Splunk.
Can anyone help me on this or any good documentation with a proper e...
12-06-2019
10:18 AM
My instance of Splunk currently has 9.4 TB of disk for indexing. We have 360GB per day being indexed and I can't increase the disk size to support this daily indexing.
I need to clean up indexed e...
- Tags:
- splunk-enterprise
10-16-2013
11:25 PM
5 Karma
I wanted to know if I am getting the data from some stream say TCP stream, where is the data stored? As I understand the data gets uploaded and indexed but some day can I get that data from Splunk? o...
11-05-2014
10:22 AM
1 Karma
Hi,
When the maxVolumeDataSizeMB for the primary volume is exceeded, will the events automatically roll over to the secondary volume?
Here are my settings:
[volume:primary]
path = /a...
11-13-2019
12:23 PM
Where and how can I set the data retention on Splunk?
Because I have seen there are many bow to set it like telemetry, main etc..
So it's really not clear...
05-16-2018
11:26 AM
...ndex?
or only in "indexes.conf" that is located in $SPLUNK_HOME/etc/system/local
I need to assure the logs one year in splunk.
regards.
- Tags:
- splunk-enterprise
03-09-2015
03:44 AM
...ommand line :
./splunk clean eventdata -f
and I have tried to erase all my log from the splunk folder, but I have still the same problem.
Please can someone help me?
