Data retention in Splunk Observability Cloud

Data retention for Splunk Observability Cloud.

The following sections list the data retention for each product in Splunk Observability Cloud.

Note: To learn more about archived metrics, see Archived metrics.

Data retention in Application Performance Monitoring (APM)

The following table shows the retention time period for each data type in APM.

Data type

Retention

Traces

  • All raw traces: 8 days

  • Traces of interest viewed in the Splunk APM user interface: up to 13 months. See Configure extended trace retention to learn how to extend the retention of specific traces of interest.

Troubleshooting MetricSets

  • 8 days

Monitoring MetricSets

  • 13 months

AlwaysOn Profiling and Call Graph Profiling data

  • 8 days

Data retention in Database Monitoring

Normalized queries and query samples are stored for 15 days.

Data retention in Infrastructure Monitoring

The following table shows the retention time period for each data type in Infrastructure Monitoring.

Data resolution

Retention

Less than 1 minute

  • Standard license edition: 8 days

  • Enterprise license edition: 3 months (96 days)

1 minute or more

  • 13 months (416 days)

Data retention in Real User Monitoring (RUM)

The following table shows the retention time period for each data type in RUM.

Data type

Retention

Spans

  • 8 days

Troubleshooting MetricSets

  • 8 days

Monitoring MetricSets

  • 13 months

Session Replay

  • 8 days

Data retention in Splunk On-Call

Data collected by Splunk On-Call is retained by default unless a specific request is made for the data to be deleted.

This table outlines the retention periods for the different types of data and how the data is accessed.
Data type Retention period
Incidents/events Retained for 13 months or 10,000 incidents/events, whichever comes first. Users may pull multiple reports to gather data exceeding 10,000 incidents if they fall within the 13-month window.
Viewable Timeline data Retained for 7 days or 1,000 events, whichever comes first.
API reporting Retains almost all historical incident data.
For more information, see Splunk Data Retention Policy Splunk On-Call and Splunk On-Call Security FAQ.

Data retention in Splunk Synthetic Monitoring

The following table shows the retention time period for each data type in Splunk Synthetic Monitoring.

Data type

Retention

Run results

  • Standard license edition: 8 days

  • Enterprise license edition: 3 months

Metric data

  • 13 months for both Standard and Enterprise.