Two questions regarding Dynamic Data Storage:
1) Within an Index, can I archive a specific sourcetype only or can I only archive the entire index?
2) Let's say Index main has searchable time of 365 days. I select dynamic data storage < Splunk Archive < and specify Archive Retention Period of 365 days.
Does that mean when original event data reaches 365 days, it will move to splunk storage as Frozen and be available for another 365 days? Why is there no option to define max size?
Hi @trojan_81,
about your questions, I think that you should read at https://docs.splunk.com/Documentation/Splunk/8.0.6/Indexer/Howindexingworks
Anyway, Splunk data are archived in buckets and archiving is managed at bucket level, in other words, Splunk archives a buckets, according with the configured policies when it reaches one of the following conditions:
So answering to your questions:
Ciao.
Giuseppe