Configuring the retention period for payload indexes
By default, IBM® QRadar® sets 30 days for the data retention period of the payload index. You can search for specific values in quick filter indexes beyond 30 days by changing the default retention in QRadar.
Before you begin
Your virtual and physical appliances require a minimum of 24 GB of RAM to enable full payload indexing. However, 48 GB of RAM is suggested.
The minimum and suggested RAM values applies to all QRadar systems, such as 16xx, 17xx, or 18xx appliances, that are processing events or flows.
About this task
Note: Quick Filter
searches that use a time frame outside of the Payload Index Retention setting can trigger slow and
resource-intensive system responses. For example, if the payload index retention is set for 1 day,
and you use a time frame for the last 30 hours in the search.
Procedure
- On the navigation menu ( ), click Admin.
- In the System Configuration section, click System Settings.
- In the Database Settings section, select a retention time period from the Payload Index Retention list.
- Click Save.
- Close the System Settings window.
- On the Admin tab, click Deploy Changes.