Splunk Cloud Platform

Splunk Cloud DDAA

splunkcol
Builder

Sorry for the bad translation.

I have a Cloud client.

The license is 50GB by day

Additional DDAA has been contracted about what is not very clear to me, the shared documentation seems to be outdated or not available.

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/User/DataArchiver

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/Service/SplunkCloudservice#Storage

https://docs.splunk.com/Documentation/SplunkCloud/8.0.2007/Service/SplunkCloudservice#Search

splunkcol_0-1651792160557.png

When I go to "Settings" - "Indexes" I can see the indexes used by this client and the others that are internal to splunk from what I see.

 

I see that one of the indexes has already reached the maximum size of 500GB and I don't know if it has the DDAA active.

splunkcol_1-1651792240438.png

According to this image I understand that the DDAA is active? I must do something?

I am worried if information is being lost since the client needs to retain that data for a long time

splunkcol_2-1651792407010.png

 

 

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Once DDAA is activated for an index, there is nothing more you need to do.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

@splunkcol There have been OOB conversations lately about some confusion over the DDAA period.  It's common (and reasonable) to think the Searchable Retention and the Archive Retention are separate measurements, but that is not the case.  As the text under Archive Retention says, the number includes the time the data spent as Searchable.  IOW, the settings shown will result in the data being frozen after 365 days and not archived.  To archive data for 365 days after it's been searchable for 365 days, set DDAA to 730.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Once DDAA is activated for an index, there is nothing more you need to do.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...