Deployment Architecture

Is the hybrid search head limited to 90 days

Path Finder


I recently completed the Splunk Cloud Admin course and it made mention that a Hybrid Search Head could be set up on-prem to read data across on-prem and cloud.

I have also read about this here and all seems fine:          

Splunk Cloud Platform Service Details  

But now I have just listened to this video “Apps for Splunk Cloud - Premium Apps” here    


Then go into the course and play the THIRD video and listen to time from 3:10 to 3:25 it says that the use of a Hybrid search is only for up to 90 days. 

Perhaps that video is out of date or perhaps I am misunderstanding.

Does anyone know about this 90 day limit as we have several customers moving to the cloud and several want Hybrid search as an option.


Labels (1)
0 Karma

Path Finder

Hi Scelikok,

I don't think that's the reason.  They do go on to say that hybrid search imposes performance issues especially  over time if the cloud gets upgraded and the on-prem doesn't.   Hopefully we will find out more as hybrid seems a good solution for the rare time when a longer search is required.  


0 Karma


Hi @KeithH,

It may be said because of default 90 days storage sizing. 

"Ingest-based subscriptions include sufficient storage to allow you to store up to 90 days of your uncompressed data."


If this reply helps you an upvote is appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...