Splunk Search

Is there a way to keep specific logs for a longer retention time for historical searches?

daniel_augustyn
Contributor

Is there a way in Splunk to tag some specific logs and keep them for longer retention time? So for example, I want to tag several logs from firewall index, and I don't want these logs to be overwritten ever with new logs. How should I preserve these logs in Splunk, for example logs related to incidents, etc. Just the thoughts if Splunk has this feature?

0 Karma
1 Solution

woodcock
Esteemed Legend

You can use collect to dump the ones that you would like to keep into a Summary Index and have a much longer retention period for those.

View solution in original post

woodcock
Esteemed Legend

You can use collect to dump the ones that you would like to keep into a Summary Index and have a much longer retention period for those.

MuS
SplunkTrust
SplunkTrust

Hi daniel_augustyn,

Since retention is index based, it is not possible to do this in one or the same index.
But you can create the tags for those events http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/TagandaliasfieldvaluesinSplunkWeb and use the tags in a search in combination with collect http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Collect to add them to another indexer which will not expire nor will be overwritten.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...