Splunk Search

how long metadata last, retention policy?

splunkreal
Motivator

Hello,

I'm using metadata on hosts to get their first event time etc, are they accurate even on oldest records?

| metadata type=hosts

By the way where are they stored?

Thanks 🙂

* If this helps, please upvote or accept solution if it solved *
Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @splunkreal,

These records are accurate if you run this search with All Time range. 

If you specify a time range other than All Time for your search, the search results might not be precise. The metadata is stored as aggregate numbers for each bucket on the index. A bucket is either included or not included based on the time range you specify.

The retention is the same as with particular index setting.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/SearchReference/Metadata#Time_ranges 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @splunkreal,

These records are accurate if you run this search with All Time range. 

If you specify a time range other than All Time for your search, the search results might not be precise. The metadata is stored as aggregate numbers for each bucket on the index. A bucket is either included or not included based on the time range you specify.

The retention is the same as with particular index setting.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/SearchReference/Metadata#Time_ranges 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

splunkreal
Motivator

Awesome thanks

* If this helps, please upvote or accept solution if it solved *
0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...