![]() ![]() Splunk Cloud Platform does not delete data from the Splunk Cloud Platform environment until it has successfully moved the data to the archive. If an error occurs, the error is logged to the splunkd.log. It can take up to 48 hours from the archive initiation for the archiving process to complete. If an error occurs, if there are connection issues, Splunk Cloud Platform attempts to move the data every 15 minutes until it can successfully move it. When that threshold is met, Splunk Cloud Platform attempts to move the data to the archive location. ![]() ![]() You can also track archived and restored data storage consumption, as well as the growth and expiration of your archived data.ĭynamic Data Active Archive moves data from your Splunk Index to a Splunk-maintained archive, and subsequently back from the Splunk-maintained archive to the Splunk Index in a secure and tamper-resistant manner.ĭata is moved to the archive when the index meets a configured size or time threshold. You can manually clear restored data or let it auto-expire from searchable storage after 30 days. You can restore archived data to your Splunk Cloud Platform environment for searching within the configured archival retention time period. You can configure Splunk Cloud Platform to automatically archive the data from an index when the data either reaches a specified maximum size or the end of the Splunk Cloud Platform searchable retention period for an index. This give you the flexibility to archive only the specific data that you need to maintain. You specify archiving at the index level by creating an archiving rule for a specified index. You can use DDAA to maintain access to older data for compliance purposes. Store expired Splunk Cloud Platform data in a Splunk-managed archiveĭynamic Data Active Archive (DDAA) lets you move your data from your Splunk Cloud Platform indexes to a Splunk-managed archive. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |