Is it possible to set retention policies on indexed data based on sourcetype?

[brent_weaver]

We are in a slight dilemma where we are trying to reduce down the number of indexes we have, understanding that this impacts retention and security. Security is not really an issue, it is retention we are trying to tackle. Since everything is sourcetyped, is it possible to set retention periods on different sourcetypes? I am pretty sure I can write a search to to delete the data, but is there a better way?

[s2_splunk]

Unfortunately not, retention settings are applied to an index only.
How many indices do you have today, what drives your desire to deduce the number?
How many different retention requirements do you have and how long are the retention times before you freeze/delete data?

You may be able to let time help you by creating the new set of indexes with appropriate retention settings, changing your data ingest path to use those new indexes depending on sourcetype and wait until data has aged out of old indexes, then delete them.
You'll have to modify existing searches to include new indexes and remove old ones once you're done. A good way would be to define macros, like set_index_for_xxx and have that macro expand to (index=xxxIndex OR index=newXxxIndex). You could leave those macros in place even after you are done, so you only have to modify your searches once.

[somesoni2]

THe retention is set only on the Index and not sourcetype. Deleting data, using delete command, doesn't really claims back the disk space, but may work for you if you're just looking to hide the data from users beyond the assigned retention period for sourcetype.

My suggestion would be to standardize the retention periods and create one each index for each retention period category that you've. The sourcetypes should go to an index based on the retention period they should have. One performance impact will using this approach is that correlation between different sourcetype can be slower as with different index, your correlation query needs to hit multiple indexes.