Metric rollup

[brandy81]

Hi All,

I have a question about metric rollup.

https://docs.splunk.com/Documentation/Splunk/latest/Metrics/MRollupsOverview

As stated by the document, metric rollup is for saving storage. Saying there are source metric index(A) and target metric index(B). Then, how is it for saving storage? Origin data indexed in index(B) is rolled up into index(B), which means taking more storage. My question is this: do I have to delete source index(A) periodically? How to handle source index in metic rollup environment?

[ITWhisperer]

Essentially, yes. Once you have extracted the metric data from the raw events, you can delete the raw events. For example, the raw events might be useful for looking at current issues, but let's say after 3 months, the data is too old to be of any value for problem analysis. However, it might be useful to know how traffic flow has changed over the last 6 months or a year. You don't need the raw data for this, you just need some useful metrics from the data, e.g. hourly counts, hourly average response times, etc. So, you collect this metrics data and keep that while removing raw events older than 3 months.

[brandy81]

Hi @ITWhisperer Thank you for the answer. I meant that the source index(A) is the metric index, not the event index. I meant source(A)/destination(B) are metric indexes both. Is your answer still valid in this circumstance? Additionally, I have a question. How do I delete the source index? By setting shorter retention policy? I have never seen that the metric rollup is used in the real world...