Splunk Search

how long metadata last, retention policy?

realsplunk
Motivator

Hello,

I'm using metadata on hosts to get their first event time etc, are they accurate even on oldest records?

| metadata type=hosts

By the way where are they stored?

Thanks 🙂

Labels (2)
0 Karma
1 Solution

scelikok
Champion

Hi @realsplunk,

These records are accurate if you run this search with All Time range. 

If you specify a time range other than All Time for your search, the search results might not be precise. The metadata is stored as aggregate numbers for each bucket on the index. A bucket is either included or not included based on the time range you specify.

The retention is the same as with particular index setting.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/SearchReference/Metadata#Time_ranges 

If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
Champion

Hi @realsplunk,

These records are accurate if you run this search with All Time range. 

If you specify a time range other than All Time for your search, the search results might not be precise. The metadata is stored as aggregate numbers for each bucket on the index. A bucket is either included or not included based on the time range you specify.

The retention is the same as with particular index setting.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/SearchReference/Metadata#Time_ranges 

If this reply helps you an upvote is appreciated.

View solution in original post

realsplunk
Motivator

Awesome thanks

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.