35.0 Forwarding Data to OpenSearch

Sentinel stores data in file-based traditional storage and indexes data locally on the Sentinel server by default. When you enable event visualization, Sentinel stores and indexes data in OpenSearch in addition to file-based traditional storage. The dashboards display only the events processed after you enabled event visualization. To view existing events present in file-based storage, you must forward data from file-based storage to OpenSearch. To forward data to OpenSearch, see Section 36.0, Migrating Data.