How should I go about Splunk DDAA storage?

Deployment Architecture

Hi,

In Splunk cloud environment we are using Splunk DDAA to archive the data for 1 year(DDAA retention period). But when i try to restore the data more than 1 year still its restoring.Can someone suggest why its restoring more than a year.

Also suggest how much storage is required for DDAA. If I'm ingesting 50 GB per day and DDAA retention period is 1 year.

Thanks!

Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Are you a member of the Splunk Community?