Skip to main content
Sumo Logic

Beta - Manage Indexes with Multi-retention

With Multi-retention, you can create Index Partitions and Scheduled Views to store your data as needed, and set different retention periods for Partitions and Scheduled Views.

Your company log data comes in many types, and different types of data may require different retention periods. For example, some sensitive information may require a short life span, while other vital data, such as customer logins, may require a longer lifespan for daily use. Still other data may need to be available for historical analysis and to gather metrics to make business decisions, though it is not accessed every day.

With Multi-retention, you can create Index Partitions and Scheduled Views to store your data as needed, and set different retention periods for those Partitions and Scheduled Views. This way, you can keep the data you need for as long as you need it, while other less important data can be retained for a shorter period, reducing your overall cost of operation.

You will set the retention period when you first create the Partition or Scheduled View, and you can also edit the retention period at any time in the future. 

The minimum retention period is 1 day, and the maximum retention period is 5,000 days.

On the Manage > Indexes page, there is a tab for Partitions and a tab for Scheduled Views.

On the Partitions tab, the first entry will always be the General Index, which is made up of:

  1. The Default Index, which includes data that does not match any Partition’s routing expression.
  2. The Sumo Logic Audit Index, which includes data stored in Source Categories such as sumologic_audit, sumologic_volume, and more. For details, see Enable and Manage the Audit Index.
  3. Views populated by Scheduled Searches.

The default retention period of the General Index is 365 days.

Here you can see the total volume ingested in each Partition, including:

  • Index Name
  • Routing Expression
  • Storage Consumed
  • Retention Period
  • Data Forwarding (Beta feature)

From the blue arrow menu on the right, you can select the following actions:

Edit the Retention Period

You may edit the retention period of Partitions and Scheduled Views. The minimum retention period is 1 day, and the maximum retention period is 5,000 days.

  1. Go to Manage > Indexes.
  2. On the Partitions or Scheduled Views tab, hover over the item you would like to edit the retention period for.
  3. Click the blue arrows on the right, and from the menu select Edit Retention Period. (You may also edit the retention period from the expanded information dialog. Next to Retention Period, click Edit.)
  4. In the Edit Retention Period dialog, enter the new retention period in days. Or you may also select the check box Apply the retention period of the General Index.
    1. If the new retention period is longer than the previous period, click Save.
    2. If the new retention period is shorter than the previous period, a portion of your data will be deleted in 7 days or right away. Click Save and choose either:
      1. Simulate this data deletion for a few days and then reduce it permanently by selecting Reduce retention period after 7 days. You will be billed for this data until the deletion is permanent, but it gives you a sense of how the deletion will impact you before it is final.
        Multi-retention reduce retention
      2. Or, if you are sure you want to proceed and end billing for this data immediately, enter DELETE in the text box, then click Reduce retention period immediately.
        Multi-retention delete retention immediately
  5. The retention period is updated and displayed in the Retention Period column. If you used the reduce retention after 7 days option, you can undo your data retention until the date specified by clicking Click here to undo the reduction in retention period.
    Multi-retention remove retention