Splunk Cloud DDAS / delete?

[KendallW]

We all know that Splunk Enterprise calculates license usage at index time, and the "| delete" command essentially just hides data from search so doesn't free up license usage. 

My question is whether this works the same way for Splunk Cloud / DDAS, or whether if I run "| delete" from search,  will it free up space in my DDAS entitlement? 

[PickleRick]

No. Splunk Cloud "underneath" is essentially the same indexing and searching machinery embedded within some additional management layer. So the delete command works exactly the same - it masks the data as "unreachable". It doesn't change anything else - the data has already been ingested so it counts against your license entitlement.

[shivanshu1593 · Accepted solution]

The delete command essentially works in the same way in Splunk Cloud as it does in an on-prem infrastructure. It won't delete your data from DDAS, but will make it unsearchable.