topic Archiving incident-related observability data beyond standard retention periods in Open Q&A

Archiving incident-related observability data beyond standard retention periods

FranciscoMPalos — Wed, 26 Aug 2026 11:11:57 GMT

In our organization, the SRE team has raised the following requirement:

When an incident occurs, they want to preserve all logs, traces, and metrics collected during the affected day so that they can continue investigating and performing data analysis for an indefinite period of time.

From an Observability perspective, what solutions could we provide to address this need?

We have tried to guide them towards using Dynatrace Notebooks, but their concern is that the underlying data may no longer be available after some time due to retention limits. What they are looking for is the ability to come back weeks or months later and still have access to the same data set in order to continue the investigation and analysis.

Has anyone faced a similar requirement? What would be the recommended approach in Dynatrace for long-term preservation of incident-related observability data?

Re: Archiving incident-related observability data beyond standard retention periods

sujit_k_singh — Thu, 27 Aug 2026 04:56:27 GMT

Hi @FranciscoMPalos

Custom bucket retention — set up a dedicated bucket with longer retention and route incident data into it via a bucket assignment rule.

Export the incident slice out of Dynatrace entirely — this is what most teams actually end up doing for "indefinite." Run the DQL for that day/incident, dump logs/traces/metrics to CSV/JSON, push to S3 or wherever. We wired a Workflow to auto-trigger this the moment a problem gets flagged as an incident basically takes a snapshot and archives it outside the platform. That way retention policy stops mattering.

Notebooks alone won't save you — like you noticed, the notebook keeps the queries but not the underlying data once it ages out. If you want notebooks to stay useful months later, export the query results alongside them, don't rely on live re-execution.

Realistically: long-retention bucket for active incidents + auto-export workflow on incident creation is the combo that's held up for us.

Thanks,

Sujit