Is there Splunk support for remaining 90 day data retention?

[anandhalagaras1]

We have Splunk Cloud deployed in our environment and we have set the default data retention that is 90 days.

So for example if I require the data for the last 180 days I can able to search the logs in Splunk cloud for the last 90 days, and for the remaining 90 days- will the data be archived anywhere at the backend by Splunk support?

So if we require those logs will Splunk support be able to provide the same via offline?

And usually, we want to know whether Splunk support archives our old data which is more than 90 days? Since we require those data for legal purpose whether they can able to provide the same.

[richgalloway]

By default, Splunk Cloud stores data for 90 days. Anything older than that is deleted and cannot be restored. If you need longer retention periods, you need to contact your Splunk sales rep and buy additional storage.