Splunk Enterprise Security

What is the retention period for summaries generated by Data Models?

VK18
Explorer

We have activated several data models for use with Splunk Enterprise security scenarios and are interested in clarifying the retention period for the summaries generated by these data models. According to the Splunk documentation, the retention period is determined by the accelerated summary range.

For instance, if our network traffic accelerated summary range is set to 15 days, does this imply that the retention period is also 15 days, and that it stores 15 days' worth of summaries?

Labels (1)
Tags (2)
0 Karma

meetmshah
Contributor

Hello @VK18, If you are using ES, you would be able to see the Retention Period under ES -> Audit -> Data Model Audit - 

meetmshah_0-1696076584736.png

You can also see the retention period through below search - 

| rest /services/admin/summarization by_tstats=t splunk_server=local count=0
| eval key=replace('title',"tstats:DM_".'eai:acl.app'."_",""),datamodel=replace('summary.id',"DM_".'eai:acl.app'."_","")
| rename summary.time_range AS retention
| eval retention=retention/(60*60*24)
| table datamodel retention

Please accept the solution and hit Karma, if this helps!

0 Karma

meetmshah
Contributor

Hello, Just checking through if the issue was resolved or you have any further questions?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...