Splunk Enterprise Security

What is the retention period for summaries generated by Data Models?


We have activated several data models for use with Splunk Enterprise security scenarios and are interested in clarifying the retention period for the summaries generated by these data models. According to the Splunk documentation, the retention period is determined by the accelerated summary range.

For instance, if our network traffic accelerated summary range is set to 15 days, does this imply that the retention period is also 15 days, and that it stores 15 days' worth of summaries?

Labels (1)
Tags (2)
0 Karma


Hello @VK18, If you are using ES, you would be able to see the Retention Period under ES -> Audit -> Data Model Audit - 


You can also see the retention period through below search - 

| rest /services/admin/summarization by_tstats=t splunk_server=local count=0
| eval key=replace('title',"tstats:DM_".'eai:acl.app'."_",""),datamodel=replace('summary.id',"DM_".'eai:acl.app'."_","")
| rename summary.time_range AS retention
| eval retention=retention/(60*60*24)
| table datamodel retention

Please accept the solution and hit Karma, if this helps!

0 Karma


Hello, Just checking through if the issue was resolved or you have any further questions?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...