Reporting

Can I keep accelerated data longer than the raw data?

a212830
Champion

Hi,

I am creating a data model, which is based upon an index with 90 days retention. Can I keep the accelerated data for a longer period of time than the 90 days, or are the tied together?

0 Karma

woodcock
Esteemed Legend

No, the accelerated data is an index on top of the raw data. What you can do is roll up aggregate data into a Summary Index which can be used in almost the same way with almost the same benefits and it is NOT tied to the raw data (except to generate it):

https://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Usesummaryindexing

0 Karma

a212830
Champion

So, the accelerated data (via data model) is not tied to the raw data? My preference is to avoid summary indexing. Seems like the doc is saying the the accelerated data will get removed when the raw data is removed.

0 Karma

woodcock
Esteemed Legend

Your question is "Can I keep it" and my answer is "No", definitely not.

0 Karma

woodcock
Esteemed Legend

But you can keep Summary Index data differently than raw.

0 Karma

davebrooking
Contributor

The Knowledge Manager documentation states

By default, Splunk software creates each data model acceleration summary on the indexer, parallel to the bucket or buckets that cover the range of time over which the summary spans, whether the buckets that fall within that range are hot, warm, or cold. If a bucket within the summary range moves to frozen status, Splunk software removes the summary information that corresponds with the bucket when it deletes or archives the data within the bucket.
So from that I'd say they are tied together.

Dave

a212830
Champion

Thanks. Well, that sucks. Kind of forces my hand to try summary indexing...

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...