Retention is always based/calculated on receipt time regardless of what is parsed out for message time.
- Search API request fails with "HTTP ERROR 401 Full authentication is required to access this resource"
- Is there a way to forward the parsed fields used in the scheduled views via Data Forwarding in Sumo Logic?
- Received "You have reached the maximum number of tabs." popup while opening new tab in Sumo Logic UI
- Live Dashboard says "No Data to Display" but running the interactive query returns results
- How can I sub-parse an already extracted field or metadata value?