Splunk Maxtotaldatasizemb, If you are losing everything that is older than 3 months, I would especially look for the .