What is the default retention time in Splunk Cloud and what is the cost of extending it?

[hettervik]

Hi,

I've started looking into Splunk Cloud for some customers. At the official Splunk website it says that the Splunk Cloud subscription includes storage for 90 days, but that additional storage is available. Though, at the official Splunk doc pages, it says that "you can modify the default [retention] setting of 1,825 days (5 years) with a value from 0 to 36,500." I somehow doubt that I can set my retention time to 100 years without any extra cost. So which one is it, 90 days or 5 years? I'll provide the links.

http://www.splunk.com/en_us/products/pricing.html#tabs/cloud
http://docs.splunk.com/Documentation/SplunkCloud/latest/User/Manageindexes

Also, if the retention time is indeed 90 days, how do I extend that time and what is the cost of doing so?

Thanks!

Regards,
Martin

[dcharboneau_spl · Accepted solution]

The default retention is 90 days for SplunkCloud. Additional Storage units can be purchased but you will have to get with a Splunk Sales team member for those details.

[hettervik]

Hi, I have a follow-up question. Whenever I create an index in Splunk Cloud I can set the retention time to whatever I want, so where does the "default" retention on 90 days take effect? Is it so that if I set a retention time to 150 days, data will still be deleted after 90 days?