Data is not searchable when it is under searchable retention.

Available Languages

Updated:September 29, 2026
Document ID:SPLK049209

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

When running a search query with an index that has searchable retention set to 180 days, some data may not be available when it's within the retention period.

Investigation

  • Index searchable retention is set to 180 days.

 

  • When searching logs from one month ago, most of the data is missing.

    image.png

 

  • Max Size is 200 GB and Current Size is 204.44 GB

image.png


    Resolution

    • This behavior is expected when the current size of the index exceeds the max size. Splunk will archive the old data to prevent the current size from exceeding the max size limit.
       

    • To ensure the data is searchable, you need to set the max size to a number large enough to store all 180 days of data, or set it to 0 for unlimited storage.

    Revision History

    Revision Publish Date Comments
    1.0
    29-Sep-2026
    Initial Release

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products