Can I have an accelerated search summary for 1 year if the index retention time is set to 90?

[ericg57]

I am attempting to come up with a solution to hold log data for 180 days for data within an index that has a retention time of 90 days? Initially I thought of the summary index, but was advised that we should try report acceleration first if holding data for less than a year. I am also open to using a datamodel summary so that i can use tstats to return data much faster. Will the report acceleration option save the data independently of the original raw data that will us to keep the same 90 day retention period and access or should we go ahead and add to the summary index?

[ericg57]

Thanks Chris,

I am going to stick with the accelerated search then and allow splunk to auto fix itself for the summary range. Would you agree that we should save summary indexing for data needed for longer than a year or for queries that can’t be accelerated. Also, I would assume that data model accelerated searches operate the way?

[chrisyounger]

Yes this is fine to have summary index longer than the index retention

[ericg57]

Hi Adonia

I may have solved it shortly after posting. The data needed for 180 days is three fields from an existing index that has a retention period of 90 days. Accelerated searches add time series indexing to the existing data I read, But I’m not sure if the data accelerated is in json format and saved in a location independent of the raw data. The results are in stats format and eligible for acceleration. Also, can I index results from an accelerated search for even more efficiency?

[adonio]

can you elaborate on the use case?
is this data a portion of the raw data? statistical results? specific results?
what are you pretend to do with this data? and how?
if report, how often?