Retention is always based/calculated on receipt time regardless of what is parsed out for message time.
- How can I store data for longer than my retention period?
- If we use the Save To Index feature for alerting, what is the retention period for the same index?
- Live Dashboard says "No Data to Display" but running the interactive query returns results
- How should I achieve NOT EQUAL TO in lookup and restrict the display of the records which are there in lookup table?
- The Live Tail feature is not working. Pressing "Run" does not do anything.