How Dynamic Data Active Archive works

When the index reaches a configured size or time limit, Splunk Cloud Platform moves your data to the archive. In the event of connection issues, Splunk Cloud Platform attempts to move the data to the archive every 15 minutes until it completes the data migration successfully.

Note: It can take up to 48 hours from the archive initiation for the archiving process to complete.

If an error occurs, it is logged in the splunkd.log. Splunk Cloud Platform does not delete data from the Splunk Cloud Platform environment until it has successfully moved the data to the archive. If you need to restore the data so that it is searchable, you can restore the data to your Splunk Cloud Platform environment. You can then search the data and delete it when you have finished.

Note: When you restore archived data to Splunk Cloud Platform, it does not count against the indexing license volume for the Splunk Cloud Platform deployment.

Dynamic Data Active Archive Performance

Restoring large amounts of archived data can impact performance. Splunk Cloud Platform has checks in place to help you determine if the amount of data you want to restore is too large, and it provides a warning when the data size may impact performance. Splunk Cloud Platform will block you from restoring large amounts of data that could potentially have an extremely negative impact on performance. If this occurs, select a smaller time range.