Docs » Getting Started » Concepts » Resolution and Data Retention

Resolution and Data Retention 🔗


This information applies to you only if your organization’s subscription plan is based on the number of hosts or metrics that Infrastructure Monitoring is monitoring for you. If your organization’s usage is based on the rate at which you are sending datapoints to Infrastructure Monitoring (DPM), see Resolution and Data Retention (DPM plans only).

In Infrastructure Monitoring, the term resolution can refer to data collection intervals (native resolution, discussed here) or intervals at which datapoints are displayed on a chart (chart resolution; see Chart Resolution and Rollups).

Native resolution 🔗

Datapoints are typically sent to Infrastructure Monitoring at a regular interval, for example, once every 30 seconds. We refer to this interval as the native resolution of a time series. When plotting a graph or evaluating an analytical expression, the native resolution determines the precision and quality of the chart that you ultimately see.

For data coming in more often than every 10s, the native resolution depends on whether the datapoint was specified as high-resolution when it was sent to Infrastructure Monitoring.

  • If a datapoint is specified as high resolution when it is sent to Infrastructure Monitoring, the frequency at which it is being sent (as fine as one second) will be considered as its native resolution. In other words, if you are sending in 1s data, graphs and detectors can display or analyze the data at 1‑second intervals.
  • For standard resolution data, all metrics arriving more frequently than every 10s will be rolled up to achieve an effective native resolution of 10s. We will roll up the 1s datapoints to 10s, and graphs and detectors display or analyze the values at 10‑second intervals.

For information on how to specify that the Smart Agent should treat a metric as a high-resolution metric, see globalDimensions and extraDimensions in Agent Configuration. You can also specify that datapoints you are sending to Infrastructure Monitoring using the Splunk Infrastructure Monitoring API should be treated as high resolution.

Rollups, resolution, and data retention policies 🔗

Rollups 🔗

When Infrastructure Monitoring receives datapoints for a given metric time series, it stores five rollups for each interval, as follows:

  • Sum — The sum of all the values of the datapoints received during each interval
  • Min — The lowest value from among the datapoints received during each interval
  • Max — The highest value from among the datapoints received during each interval
  • Count — The number of datapoints received during each interval
  • Latest — The value of the most recent datapoint received during each interval

For example, if Infrastructure Monitoring receives the datapoint values 40, 50, 30, 10, and 20 (in that order) for a given time series in a 1-minute window, the 1-minute rollups will be stored as shown in the following table.

Rollup type Value
Sum 150
Count 5
Min 10
Max 50
Latest 20

Resolution 🔗

These rollups are retained at different resolutions depending on how long ago the data was received, the subscription plan that was in effect when the data arrived at Infrastructure Monitoring, and whether the datapoint was specified as high resolution when it was sent to Infrastructure Monitoring.

  • High resolution metrics can be stored at a resolution as fine as 1 second.
  • Standard resolution metrics can be stored at a resolution as fine as 10 seconds.

Retention 🔗

The following table shows how long data is retained at different resolutions.

Resolution Standard plan Enterprise or Custom plan
1 second, 10 seconds 8 days 3 months (96 days)
1 minute, 5 minutes, 1 hour 13 months (384 days) 13 months (384 days)

For more information on rollups in general, and how they apply to charts and detectors, see About rollups.