Retention Period in days per index

This query will give you a table of all indexes and their respective retention period in days:

| rest splunk_server=* /services/data/indexes | join type=outer title [
| rest splunk_server=* /services/data/indexes-extended
] | eval retentionInDays=frozenTimePeriodInSecs/86400
| table title retentionInDays
Share This:

Leave A Comment?