Splunk Search

Is there a way to do retention based on sourcetypes?

prabhu77749
Explorer

Hi rteam,

We have too many index created and now planning to have different retention duration  based on sourcetypes. Cant  go with one  index for each sourcetype, which will   impact operations and many teams who are searching fir data . 

Is there any way to do retention based on sourcetype level. Thanks in advance 

Tags (2)
0 Karma
1 Solution

Nisha18789
Builder

Hello @prabhu77749 , unfortunately retention can only be applied on indexes.

So, its better to create different indexes for those sourcetypes and define the retention policies on them.

However, in order to support smooth operations you can create macros for grouping indexes like :

parent-index : (index=indexA1 OR index=indexA2 OR index=indexA3)

so that they can be used as `parent-index` in the queries.

Hope this helps!

View solution in original post

0 Karma

Nisha18789
Builder

Hello @prabhu77749 , unfortunately retention can only be applied on indexes.

So, its better to create different indexes for those sourcetypes and define the retention policies on them.

However, in order to support smooth operations you can create macros for grouping indexes like :

parent-index : (index=indexA1 OR index=indexA2 OR index=indexA3)

so that they can be used as `parent-index` in the queries.

Hope this helps!

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...