Knowledge Management

Data Retention using Summary Indexes

ManishaAgrawal
Explorer

My data has is spread across multiple indexes and has several event types. I have to set different retention policies for them.
Is it possible to use summary index, one for each eventtype and set a different retention policy for each of them ?

Idea is to collect events from main index into summary index on a daily/weekly basis and then set a retention policy for the index.

Is there any other way to collect and move data from index to another in Splunk 6.

0 Karma

jeremiahc4
Builder

I've used the summary index for maintaining summarized data long term. By summarizing it, you are reducing the size of the data, and therefore are able to store it longer without any modifications to retention.

If you are looking at legal retention, where the data has to be in original form, then I'd suggest defining your frozen areas for the indexes in lieu of the summary index. I believe once you dump stuff out to a frozen index, that file can be archived off (i.e. moved to tape), but please check that first. See below;

http://docs.splunk.com/Documentation/Splunk/6.0.3/Indexer/Setaretirementandarchivingpolicy

0 Karma

akarivaratharaj
Communicator

Hi,

Is there any separate Data Retention Policy for the sourcetype 'stash'? Or does it behaves as per the summary or other indexing Retention Policies?

0 Karma
Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...