Is there a way to do retention based on sourcetypes?

[prabhu77749]

Hi rteam,

We have too many index created and now planning to have different retention duration  based on sourcetypes. Cant  go with one  index for each sourcetype, which will   impact operations and many teams who are searching fir data . 

Is there any way to do retention based on sourcetype level. Thanks in advance 

[Nisha18789 · Accepted solution]

Hello @prabhu77749 , unfortunately retention can only be applied on indexes.

So, its better to create different indexes for those sourcetypes and define the retention policies on them.

However, in order to support smooth operations you can create macros for grouping indexes like :

parent-index : (index=indexA1 OR index=indexA2 OR index=indexA3)

so that they can be used as `parent-index` in the queries.

Hope this helps!