how long metadata last, retention policy?

[splunkreal]

Hello,

I'm using metadata on hosts to get their first event time etc, are they accurate even on oldest records?

| metadata type=hosts

By the way where are they stored?

Thanks 🙂

[scelikok · Accepted solution]

Hi @splunkreal,

These records are accurate if you run this search with All Time range. 

If you specify a time range other than All Time for your search, the search results might not be precise. The metadata is stored as aggregate numbers for each bucket on the index. A bucket is either included or not included based on the time range you specify.

The retention is the same as with particular index setting.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/SearchReference/Metadata#Time_ranges 

[splunkreal]

Awesome thanks