Deployment Architecture

DDAA

Wesport
New Member

If my clustered Splunk cloud indexers contain data that has been deleted (marked for deletion) and that index hits its retention period for DDAA archiving, will the data marked delete be archived to DDAA storage or will it be dropped at this point. I prefer dropped is there is a configuration option for this.

 Thanks

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...