We are in a slight dilemma where we are trying to reduce down the number of indexes we have, understanding that this impacts retention and security. Security is not really an issue, it is retention we are trying to tackle. Since everything is sourcetyped, is it possible to set retention periods on different sourcetypes? I am pretty sure I can write a search to to delete the data, but is there a better way?
↧