Knowledge Management

Data Retention using Summary Indexes

ManishaAgrawal
Explorer

My data has is spread across multiple indexes and has several event types. I have to set different retention policies for them.
Is it possible to use summary index, one for each eventtype and set a different retention policy for each of them ?

Idea is to collect events from main index into summary index on a daily/weekly basis and then set a retention policy for the index.

Is there any other way to collect and move data from index to another in Splunk 6.

0 Karma

jeremiahc4
Builder

I've used the summary index for maintaining summarized data long term. By summarizing it, you are reducing the size of the data, and therefore are able to store it longer without any modifications to retention.

If you are looking at legal retention, where the data has to be in original form, then I'd suggest defining your frozen areas for the indexes in lieu of the summary index. I believe once you dump stuff out to a frozen index, that file can be archived off (i.e. moved to tape), but please check that first. See below;

http://docs.splunk.com/Documentation/Splunk/6.0.3/Indexer/Setaretirementandarchivingpolicy

0 Karma

akarivaratharaj
Communicator

Hi,

Is there any separate Data Retention Policy for the sourcetype 'stash'? Or does it behaves as per the summary or other indexing Retention Policies?

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...