Knowledge Management

Data Retention using Summary Indexes


My data has is spread across multiple indexes and has several event types. I have to set different retention policies for them.
Is it possible to use summary index, one for each eventtype and set a different retention policy for each of them ?

Idea is to collect events from main index into summary index on a daily/weekly basis and then set a retention policy for the index.

Is there any other way to collect and move data from index to another in Splunk 6.

0 Karma


I've used the summary index for maintaining summarized data long term. By summarizing it, you are reducing the size of the data, and therefore are able to store it longer without any modifications to retention.

If you are looking at legal retention, where the data has to be in original form, then I'd suggest defining your frozen areas for the indexes in lieu of the summary index. I believe once you dump stuff out to a frozen index, that file can be archived off (i.e. moved to tape), but please check that first. See below;

0 Karma



Is there any separate Data Retention Policy for the sourcetype 'stash'? Or does it behaves as per the summary or other indexing Retention Policies?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...