Can I keep accelerated data longer than the raw data?

[a212830]

Hi,

I am creating a data model, which is based upon an index with 90 days retention. Can I keep the accelerated data for a longer period of time than the 90 days, or are the tied together?

[woodcock]

No, the accelerated data is an index on top of the raw data. What you can do is roll up aggregate data into a Summary Index which can be used in almost the same way with almost the same benefits and it is NOT tied to the raw data (except to generate it):

https://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Usesummaryindexing

[a212830]

So, the accelerated data (via data model) is not tied to the raw data? My preference is to avoid summary indexing. Seems like the doc is saying the the accelerated data will get removed when the raw data is removed.

[woodcock]

Your question is "Can I keep it" and my answer is "No", definitely not.

[woodcock]

But you can keep Summary Index data differently than raw.

[davebrooking]

The Knowledge Manager documentation states

By default, Splunk software creates each data model acceleration summary on the indexer, parallel to the bucket or buckets that cover the range of time over which the summary spans, whether the buckets that fall within that range are hot, warm, or cold. If a bucket within the summary range moves to frozen status, Splunk software removes the summary information that corresponds with the bucket when it deletes or archives the data within the bucket.
So from that I'd say they are tied together.

Dave

[a212830]

Thanks. Well, that sucks. Kind of forces my hand to try summary indexing...