Manage self storage settings for an index

Enable Dynamic Data Self Storage on any Splunk Cloud Platform index to allow expired data to be stored to an Amazon S3 or GCP bucket.

Managing self storage settings requires the Splunk indexes_edit capability. All self storage configuration changes are logged in the audit.log file.

Enable self storage for an index

Prerequisite

You must have configured a self storage location. See Configure Self Storage Locations for details.

  1. Go to Settings > Indexes.
  2. Click New Index to create a new index, or click Edit in the Actions column for an existing index.
  3. In the Dynamic Data Storage field, click the radio button for Self Storage.
  4. Select a storage location from the drop-down list.
  5. Click Save.

Disable self storage for an index

If you disable self storage for an index, expired data is deleted.

  1. Go to Settings > Indexes.
  2. Click Edit in the Actions column for the index you want to manage.
  3. In the Dynamic Data Storage field, click the radio button for No Additional Storage.
  4. Click Save. Self storage is disabled for this index. When data in this index expires, it is deleted.
Note: Disabling self storage for an index does not change the configuration of the external location, nor does it delete the external location or the data stored there. Disabling self storage also does not affect the time or size of the data retention policy for the index.