Splunk Enterprise Security

What is the retention period for summaries generated by Data Models?


We have activated several data models for use with Splunk Enterprise security scenarios and are interested in clarifying the retention period for the summaries generated by these data models. According to the Splunk documentation, the retention period is determined by the accelerated summary range.

For instance, if our network traffic accelerated summary range is set to 15 days, does this imply that the retention period is also 15 days, and that it stores 15 days' worth of summaries?

Labels (1)
Tags (2)
0 Karma


Hello @VK18, If you are using ES, you would be able to see the Retention Period under ES -> Audit -> Data Model Audit - 


You can also see the retention period through below search - 

| rest /services/admin/summarization by_tstats=t splunk_server=local count=0
| eval key=replace('title',"tstats:DM_".'eai:acl.app'."_",""),datamodel=replace('summary.id',"DM_".'eai:acl.app'."_","")
| rename summary.time_range AS retention
| eval retention=retention/(60*60*24)
| table datamodel retention

Please accept the solution and hit Karma, if this helps!

0 Karma


Hello, Just checking through if the issue was resolved or you have any further questions?

0 Karma
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...