Hi everyone, I have a question about searchable data retention in Splunk Cloud (Victoria Experience). With a subscription of 500 GB/day of ingestion and the standard 90-day DDAS allocation, the total included storage would be 45 TB (500 GB/day × 90 days = 45,000 GB). Is it possible to configure different searchable retention periods per index? For example: Index Daily ingestion Retention Storage required Index A 300 GB/day 7 days 2.1 TB Index B 150 GB/day 90 days 13.5 TB Index C 50 GB/day 500 days 25 TB Total 500 GB/day 40.6 TB Since the total searchable storage consumption remains below the included 45 TB, can Index C retain 500 days of searchable data without purchasing additional DDAS or other storage add-ons? Is the standard 90-day retention a hard limit per index, or can the included DDAS capacity be distributed across indexes with different retention periods, including those exceeding 90 days? I'm specifically asking whether this is allowed without additional charges, not just whether it is technically configurable. Thanks!
... View more