Implementing Splunk 7, Third Edition - Third Edition

Differing longevity

It may be the case that you need more history for some source types than others. The classic example here is security logs, as compared to web access logs. You may need to keep security logs for a year or more, but need the web access logs for only a couple of weeks.

If these two source types are left in the same index, security events will be stored in the same buckets as web access logs and will age out together. To split these events up, you need to perform the following steps:

1. Create a new index called security, for instance
2. Define different settings for the security index
3. Update inputs.conf to use the new index for security source types

For one year, you might make an indexes.conf setting such as this:

[security] ...