Is there anyway we can set a per source retention ?
I would like to inform you that the retention period of the logs totally depends on the partition where those are stored.
With Variable Retention, you can create Index Partitions and route different types of logs to each partition and set different retention periods for those Partitions.
This way, you can keep the data you need for as long as you need it, while other less important data can be retained for a shorter period, reducing your overall cost of operation.
You set the retention period when you first create the Partition or Scheduled View, and you can also edit the retention period at any time in the future.
Retention is measured from the time that data was received, rather than the message time.
The minimum retention period is 1 day, and the maximum retention period is 5,000 days.
For more info:https://help.sumologic.com/Manage/Partitions/Manage_Indexes_with_Variable_Retention
Hope that answers your question.
Please sign in to leave a comment.