Retention is always based/calculated on receipt time regardless of what is parsed out for message time.
- Why aren't my recent logs showing up with my search?
- If we use the Save To Index feature for alerting, what is the retention period for the same index?
- What are the supported time periods for the timeslice operator?
- Search API request fails with "HTTP ERROR 401 Full authentication is required to access this resource"
- Is it possible to export metrics as csv or json data out of Sumo Logic?