SPL
Retention Period in days per index
Description
This query will give you a table of all indexes and their respective retention period in days:
4 2
| rest splunk_server=* /services/data/indexes | join type=outer title [ | rest splunk_server=* /services/data/indexes-extended ] | eval retentionInDays=frozenTimePeriodInSecs/86400 | table title retentionInDays
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.