Log files with differing retention periods

[jamesoconnell]

Can log files with different retention requirements exist and be accessed within same index?

Regards,
James O'Connell.

[dbcottam]

I have the same question and would like further instruction. How can I set up multiple search indexes? I need one for mail with a retention of four months for example and another index for proxy logs, etc.

How do I set up the indexes to the specific source? Thanks

[mikelanghorst]

No, the retention period is based upon individual indexes. If you have logs with different requirements you'll need to direct them to different indexes. You can configure roles to search multiple indexes by default to make it easier.

[jamesoconnell]

Thank you Mike for the response. I figured the answer was no, but didn't know about the role configuration across multiple indexes by default.

Let me make sure I understand what you mean -- I know I can setup a given role to search on selected indexes by default when no index is specified -- is this what you mean?

Thanks again,
James O'Connell.