topic Splunk Cloud DDAA in Splunk Cloud Platform

Splunk Cloud DDAA

splunkcol — Thu, 05 May 2022 23:20:42 GMT

Sorry for the bad translation.

I have a Cloud client.

The license is 50GB by day

Additional DDAA has been contracted about what is not very clear to me, the shared documentation seems to be outdated or not available.

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/User/DataArchiver

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/Service/SplunkCloudservice#Storage

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/Service/SplunkCloudservice#Search

When I go to "Settings" - "Indexes" I can see the indexes used by this client and the others that are internal to splunk from what I see.

I see that one of the indexes has already reached the maximum size of 500GB and I don't know if it has the DDAA active.

According to this image I understand that the DDAA is active? I must do something?

I am worried if information is being lost since the client needs to retain that data for a long time

Re: Splunk Cloud DDAA

richgalloway — Fri, 06 May 2022 00:36:42 GMT

Once DDAA is activated for an index, there is nothing more you need to do.

Re: Splunk Cloud DDAA

richgalloway — Thu, 12 Jan 2023 17:47:57 GMT

@splunkcol There have been OOB conversations lately about some confusion over the DDAA period. It's common (and reasonable) to think the Searchable Retention and the Archive Retention are separate measurements, but that is not the case. As the text under Archive Retention says, the number includes the time the data spent as Searchable. IOW, the settings shown will result in the data being frozen after 365 days and not archived. To archive data for 365 days after it's been searchable for 365 days, set DDAA to 730.