Deployment Architecture

Is there Splunk support for remaining 90 day data retention?


We have Splunk Cloud deployed in our environment and we have set the default data retention that is 90 days.

So for example if I require the data for the last 180 days I can able to search the logs in Splunk cloud for the last 90 days, and for the remaining 90 days- will the data be archived anywhere at the backend by Splunk support?

So if we require those logs will Splunk support be able to provide the same via offline?

And usually, we want to know whether Splunk support archives our old data which is more than 90 days? Since we require those data for legal purpose whether they can able to provide the same.

0 Karma


By default, Splunk Cloud stores data for 90 days. Anything older than that is deleted and cannot be restored. If you need longer retention periods, you need to contact your Splunk sales rep and buy additional storage.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...