How to find the retention period of internal indexes

Available Languages

Updated:September 29, 2026
Document ID:SPLK045641

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

To determine what retention period for all internal Splunk indexes , eg _internal as an example, the following searches can be used as from the Splunk GUI internal indexes cannot be seen via Settings > Indexes

Investigation

From Splunk Search App

Run the following search:

| rest  /services/data/indexes
   | join type=outer title [
     | rest  /services/data/indexes-extended
   ]
| search title=_*
|  eval retentionInDays=frozenTimePeriodInSecs/86400
| table title retentionInDays | dedup title

Resolution

In Splunk Cloud and well-architected Splunk environments, Search Heads do not store data buckets and therefore do not participate in data retention. Retention policies must be set on the indexers only.

 

The command | rest /services/data/indexes run from a Search Head does not accurately reflect retention settings on indexers, as the dispatch_rest_to_indexers capability is not available to the users.

 

To view the actual retention period for internal indexes, install and use the Admins Little Helper for Splunk application.

 

Within this app, run the following SPL to retrieve frozen time retention details from indexers:

 

 btool indexes list _ splunk_server=idx-*
| stats values(frozenTimePeriodInSecs) by btool.stanza

Admins Little Helper for Splunk application.

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles