What is the retention period for summaries generated by Data Models?

[VK18]

We have activated several data models for use with Splunk Enterprise security scenarios and are interested in clarifying the retention period for the summaries generated by these data models. According to the Splunk documentation, the retention period is determined by the accelerated summary range.

For instance, if our network traffic accelerated summary range is set to 15 days, does this imply that the retention period is also 15 days, and that it stores 15 days' worth of summaries?

[meetmshah]

Hello @VK18, If you are using ES, you would be able to see the Retention Period under ES -> Audit -> Data Model Audit - 

You can also see the retention period through below search - 

| rest /services/admin/summarization by_tstats=t splunk_server=local count=0
| eval key=replace('title',"tstats:DM_".'eai:acl.app'."_",""),datamodel=replace('summary.id',"DM_".'eai:acl.app'."_","")
| rename summary.time_range AS retention
| eval retention=retention/(60*60*24)
| table datamodel retention

Please accept the solution and hit Karma, if this helps!

[meetmshah]

Hello, Just checking through if the issue was resolved or you have any further questions?