Reporting

Can I keep accelerated data longer than the raw data?

a212830
Champion

Hi,

I am creating a data model, which is based upon an index with 90 days retention. Can I keep the accelerated data for a longer period of time than the 90 days, or are the tied together?

0 Karma

woodcock
Esteemed Legend

No, the accelerated data is an index on top of the raw data. What you can do is roll up aggregate data into a Summary Index which can be used in almost the same way with almost the same benefits and it is NOT tied to the raw data (except to generate it):

https://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Usesummaryindexing

0 Karma

a212830
Champion

So, the accelerated data (via data model) is not tied to the raw data? My preference is to avoid summary indexing. Seems like the doc is saying the the accelerated data will get removed when the raw data is removed.

0 Karma

woodcock
Esteemed Legend

Your question is "Can I keep it" and my answer is "No", definitely not.

0 Karma

woodcock
Esteemed Legend

But you can keep Summary Index data differently than raw.

0 Karma

davebrooking
Contributor

The Knowledge Manager documentation states

By default, Splunk software creates each data model acceleration summary on the indexer, parallel to the bucket or buckets that cover the range of time over which the summary spans, whether the buckets that fall within that range are hot, warm, or cold. If a bucket within the summary range moves to frozen status, Splunk software removes the summary information that corresponds with the bucket when it deletes or archives the data within the bucket.
So from that I'd say they are tied together.

Dave

a212830
Champion

Thanks. Well, that sucks. Kind of forces my hand to try summary indexing...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...