Lookup File data retention Question

newbie2tech — Fri, 17 Aug 2018 15:22:59 GMT

Hi Team,

I have requirement to show last 90 days worth of app login stats broken by day.

I have a lookup table/defnition created and i have saved search that writes the summary data every morning 5 am for the previous day onto the lookup.

Question i got, is there any time limitation until which lookup will retain this data before which it starts truncating or deleting data? I expect the data would remain intact however i wanted to check with wider audience to see how your experiece has been.

I understand better way would be to either create summary index or kv store, i am not going that route as it would need 2 weeks to get it out to production in my space and i need something quick.

Please share your thoughts.

Mine is clustered environment (both SH & indexers) , version is 6.6+

Thanks!

Re: Lookup File data retention Question

pradeepkumarg — Fri, 17 Aug 2018 15:27:29 GMT

There is no retention for lookups. The lookup will stay until some one deletes it or overwrites it.

Re: Lookup File data retention Question

kvswathi — Thu, 16 May 2019 10:53:19 GMT

Hey , you can try "Search-Driven Lookup" , there you can set retention for a lookup.

https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Createsearchdrivenlookups

topic Lookup File data retention Question in Splunk Search

Lookup File data retention Question

Re: Lookup File data retention Question

Re: Lookup File data retention Question