change defaults for testing, remove measurements list since cq uses wildcard now - https://github.com/Security-Onion-Solutions/securityonion/issues/3264

salt/influxdb/defaults.yaml

@@ -2,34 +2,12 @@ influxdb:
   retention_policies:
     autogen:
       default: True
-      duration: 1h
+      duration: 2d
       shard_duration: 1h
     so_long_term:
       default: False
-      duration: 2d
+      duration: 7d
       shard_duration: 1d
   downsample:
     so_long_term:
-      resolution: 5m
-      measurements:
-        - cpu
-        - disk
-        - diskio
-        - docker_container_cpu
-        - docker_container_mem
-        - docker_container_net
-        - elasticsearch_indices
-        - elasticsearch_jvm
-        - esteps
-        - healthcheck
-        - influxsize
-        - mem
-        - net
-        - pcapage
-        - processes
-        - redisqueue
-        - stenodrop
-        - suridrop
-        - system
-        - zeekcaptureloss
-        - zeekdrop
+      resolution: 5m