Hello! Here are the recap materials from the session:

• On-Demand recording
• Slide Deck

Here are the questions that we received in the session (more detailed solutions and info can be found in the slide deck)

Q1: What is the best strategy to reduce ingestion costs? is there a way to show how much is being reduced? 

A: 

• Archive all Unused Metrics
• Figure out lowly used metrics
• Sign up for Automated Archiving to Automate

Documentation:

• Pipeline Management 
• Usage Analytics
• Data Management
• More Usage Story(Blog)
• Archived Metrics(Blog)
• Logs Metricization 
• The New Rules of Data Management (E-Book)
• Building a self service observability practice (Tech Talk)

Q2: What are the best recommendations relating to data retention in Splunk, or even cold restore?

A: 

Metrics

• 1 Second Resolution: 3 Months
• 10 Seconds or more: 13 Months

APM

• Raw Traces: 8 Days
• Traces of interest viewed in the Splunk APM user interface: up to 13 Months
• Profiling Data: 8 Days

RUM

• Spans: 8 Days
• Session Replay: 8 Days

Synthetics

• Run Results: 8 Days

Metric Data: 13 Months

Logs

• Varies by industry, regulations, source, and organization policies. See the Splunk Lantern article for more details and recommendations.

Other

• Troubleshooting MetricSets: 8 days
• Monitoring MetricSets: 13 Months

Documentation:

• Data Retention in Splunk Observability Cloud
• Configure Extended Trace Retention
• Setting data retention rules in Splunk Cloud Platform
• Learn about MetricSets in APM

Q3: How would I manage log ingestion made by fluent like we do with Splunk Universal Forwarder and props?

A: The Fluent Forward receiver allows the Splunk Distribution of the OpenTelemetry Collector to collect events using the bundled Fluentd application. The receiver accepts data formatted as Fluent Forward events through a TCP connection. All three Fluent event types, message, forward, and packed forward, are supported, including compressed packed forward. 

However, this integration will be deprecated in October of 2025 as we have shifted to native OpenTelemetry log collection.

Our best practice recommendation is as follows:

• Kubernetes: OpenTelemetry native log collection
• Stand-alone Linux/Windows hosts: Universal Forwarder log collection
• When used with Splunk Log Observer Connect, you can take advantage of effectively all Splunk Observability Cloud logging functionality, including Related Content.

Documentation:

• Fluent Forward Receiver
• Splunk Distribution of the OpenTelemetry Collector
• Log Observer Connect
• Related Content