- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How long is data stored and refreshed in Splunk Cloud?
I am working on a project in Splunk Cloud and one of the questions I wanted to iron out was how data is stored and refreshed in Splunk. The data I am analyzing is based on real-time and I am looking for active issues and how long they have been that way for. For example, if an issue has been recurring for three minutes (just an example, could be a longer or shorter time frame), then how long will the data stay in the system for? I apologize if this is vague, but I am trying to wrap my head around how this works.
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you send data to Splunk Cloud ,It is stored on indexes. The maximum size of the index ,The maximum age of events in the index This two factor determines the data storage. maximum size of the index will specified using GB on index page.Cheap essay writing service providing best service for their customer .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The answer is...it depends. Index size and the age of the events both govern data retention. See Splunk Cloud data policies in the Splunk Cloud User Manual.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you.
I do have another question with regards to data storage. I did some research as to the quickest way to delete sets of data that you do not want to include, and here is the result I got: http://docs.splunk.com/Documentation/Splunk/6.4.1/Indexer/RemovedatafromSplunk#Remove_an_index_entir...
Is there a quicker and easier way to do this? I am just doing some trial and error work. Alternatively, can I just create an entirely new instance with the data I need?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Chris - is this the case even in a testing environment?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
By "testing environment" do you mean a free Splunk Cloud trial? If that's the situation, then there are no Support tickets. 🙂 You can always sign up for another trial if you want to experiment with a different setup.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes - my testing environment was my free trial, but it is Enterprise that is desktop based and not the Cloud. Do I need to create an entirely new account or can I piggyback off the account I already have? Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Cloud trial will be separate, although you can use the same splunk.com login. Here is the link for the free Cloud trial: http://splunk.force.com/SplunkCloud?prdType=SplunkCloud
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unlike Enterprise, I would access the Cloud trial completely online, is that correct?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, Splunk Cloud is completely SaaS.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you need to remove an index from Splunk Cloud, you have to file a support ticket. You can also just create a new index and use that, depending on the data volume you are paying for.
