Splunk Search

Does charting data age out over time?

Dimitri_McKay
Splunk Employee
Splunk Employee

Does the charting data "age" like RRD data (as an example: a 5 minute sample rate gets turned into a 15 minute average after a week, a 30 minute one after two, etc...)? Is the chart data indexed separately from the logs or do you lose data that is from buckets that have been rotated to cold/frozen storage?

0 Karma
1 Solution

Dimitri_McKay
Splunk Employee
Splunk Employee

NO, charting data is typically the same data as raw. That is, all data to splunk is first class. That said, you can either create summary indexes and then use them to deal with a all-->5m-->15m-->30m type scenario. I have had many customer do so, but in the end, the 5.0 report acceleration probably accomplishes enough and saves you the effort. NO, data is not lost as it is moved from Hot/Warm to Cold, but yes, as data is frozen, we remove the index file and keep the raw. If/when it is restored, the rebuild process is part of that. This keeps the frozen files MUCH smaller.

View solution in original post

Dimitri_McKay
Splunk Employee
Splunk Employee

NO, charting data is typically the same data as raw. That is, all data to splunk is first class. That said, you can either create summary indexes and then use them to deal with a all-->5m-->15m-->30m type scenario. I have had many customer do so, but in the end, the 5.0 report acceleration probably accomplishes enough and saves you the effort. NO, data is not lost as it is moved from Hot/Warm to Cold, but yes, as data is frozen, we remove the index file and keep the raw. If/when it is restored, the rebuild process is part of that. This keeps the frozen files MUCH smaller.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...