https://community.splunk.com/t5/Splunk-Cloud-Platform/Archiving-retention/m-p/687153#M3042 <P>When the retention period is reduced, any buckets where all data is older than the new retention period will be frozen.&nbsp; When archiving is enabled, freezing buckets means moving them to archive storage.</P> Fri, 10 May 2024 12:10:52 GMT richgalloway 2024-05-10T12:10:52Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Archiving-retention/m-p/687136#M3041 <P>Hi Everyone,</P><P>If I lower the index retention and tell it to use the archive, what happens to the logs with larger retention? Example. We currently have 1 year of retention. If we move to 6 months of retention + 18 of archiving, what happens to logs older than 6 months?&nbsp;</P> Fri, 10 May 2024 08:08:07 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Archiving-retention/m-p/687136#M3041 adivittorio 2024-05-10T08:08:07Z https://community.splunk.com/t5/Splunk-Cloud-Platform/Archiving-retention/m-p/687153#M3042 <P>When the retention period is reduced, any buckets where all data is older than the new retention period will be frozen.&nbsp; When archiving is enabled, freezing buckets means moving them to archive storage.</P> Fri, 10 May 2024 12:10:52 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/Archiving-retention/m-p/687153#M3042 richgalloway 2024-05-10T12:10:52Z