Splunk Search

Is there a way to do retention based on sourcetypes?

prabhu77749
Explorer

Hi rteam,

We have too many index created and now planning to have different retention duration  based on sourcetypes. Cant  go with one  index for each sourcetype, which will   impact operations and many teams who are searching fir data . 

Is there any way to do retention based on sourcetype level. Thanks in advance 

Tags (2)
0 Karma
1 Solution

Nisha18789
Builder

Hello @prabhu77749 , unfortunately retention can only be applied on indexes.

So, its better to create different indexes for those sourcetypes and define the retention policies on them.

However, in order to support smooth operations you can create macros for grouping indexes like :

parent-index : (index=indexA1 OR index=indexA2 OR index=indexA3)

so that they can be used as `parent-index` in the queries.

Hope this helps!

View solution in original post

0 Karma

Nisha18789
Builder

Hello @prabhu77749 , unfortunately retention can only be applied on indexes.

So, its better to create different indexes for those sourcetypes and define the retention policies on them.

However, in order to support smooth operations you can create macros for grouping indexes like :

parent-index : (index=indexA1 OR index=indexA2 OR index=indexA3)

so that they can be used as `parent-index` in the queries.

Hope this helps!

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...