topic Re: Log files with differing retention periods in Getting Data In

Log files with differing retention periods

jamesoconnell — Wed, 07 Sep 2011 20:37:40 GMT

Can log files with different retention requirements exist and be accessed within same index?

Regards,
James O'Connell.

Re: Log files with differing retention periods

mikelanghorst — Thu, 08 Sep 2011 22:53:23 GMT

No, the retention period is based upon individual indexes. If you have logs with different requirements you'll need to direct them to different indexes. You can configure roles to search multiple indexes by default to make it easier.

Re: Log files with differing retention periods

jamesoconnell — Mon, 12 Sep 2011 16:37:14 GMT

Thank you Mike for the response. I figured the answer was no, but didn't know about the role configuration across multiple indexes by default.

Let me make sure I understand what you mean -- I know I can setup a given role to search on selected indexes by default when no index is specified -- is this what you mean?

Thanks again,
James O'Connell.

Re: Log files with differing retention periods

dbcottam — Tue, 12 Jun 2012 17:22:23 GMT

I have the same question and would like further instruction. How can I set up multiple search indexes? I need one for mail with a retention of four months for example and another index for proxy logs, etc.

How do I set up the indexes to the specific source? Thanks