topic Re: Splunk Cloud DDAS / delete? in Splunk Cloud Platform

Splunk Cloud DDAS / delete?

KendallW — Mon, 01 Jul 2024 04:08:24 GMT

We all know that Splunk Enterprise calculates license usage at index time, and the "| delete" command essentially just hides data from search so doesn't free up license usage.

My question is whether this works the same way for Splunk Cloud / DDAS, or whether if I run "| delete" from search, will it free up space in my DDAS entitlement?

Re: Splunk Cloud DDAS / delete?

shivanshu1593 — Mon, 01 Jul 2024 09:49:11 GMT

The delete command essentially works in the same way in Splunk Cloud as it does in an on-prem infrastructure. It won't delete your data from DDAS, but will make it unsearchable.

Re: Splunk Cloud DDAS / delete?

PickleRick — Mon, 01 Jul 2024 13:02:27 GMT

No. Splunk Cloud "underneath" is essentially the same indexing and searching machinery embedded within some additional management layer. So the delete command works exactly the same - it masks the data as "unreachable". It doesn't change anything else - the data has already been ingested so it counts against your license entitlement.