Comments

4 comments

  • Official comment
    Avatar
    Rahul Choudhary

    Hi Magesh,

    I would like to inform you that the retention period of the logs totally depends on the partition where those are stored.

    With Variable Retention, you can create Index Partitions and route different types of logs to each partition and set different retention periods for those Partitions.

    This way, you can keep the data you need for as long as you need it, while other less important data can be retained for a shorter period, reducing your overall cost of operation.

    You set the retention period when you first create the Partition or Scheduled View, and you can also edit the retention period at any time in the future. 

    Retention is measured from the time that data was received, rather than the message time. 

    The minimum retention period is 1 day, and the maximum retention period is 5,000 days.

    For more info:https://help.sumologic.com/Manage/Partitions/Manage_Indexes_with_Variable_Retention

    Hope that answers your question.

    Regards,
    Rahul

     

     

    Comment actions Permalink
  • Avatar
    Kevin Sumo

    Currently the retention policy is only available across an account and cannot be adjusted per Source. If you can let us know your use case we can certainly file this over to the feature request topics.

    0
    Comment actions Permalink
  • Avatar
    Kevin Francis

    This would be great for us to keep audit data for longer periods of time (as defined by regulations) vs. transactional data which is of no value after a shorter period of time.

    0
    Comment actions Permalink
  • Avatar
    Magesh Rajan

    Is this feature supported now to set retention per source ? 

    0
    Comment actions Permalink

Please sign in to leave a comment.