How long does Splunk Cloud store logs?

[will_paxata]

I am using Splunk Cloud. Assuming the total storage limit is never reached, how long are my logs stored for?

[ChrisG · Accepted solution]

You configure data retention for each of your indexes. See Data policies in the Splunk Cloud User Manual.

[will_paxata]

Thanks for pointing that out.

Do you know what the default max age of events? I know that the total max size is specified by the Splunk Cloud license, but I cannot find any information on the default max age.

[ChrisG]

Looking in the Splunk Enterprise Managing Indexers and Clusters of Indexers manual, the Set a retirement and archiving policy topic says that the default value of frozenTimePeriodInSecs is 188697600 seconds, or approximately 6 years.

[will_paxata]

I'll assume that is the default for Splunk Cloud as well. Thank you, ChrisG!