Use the Archive Management panel

For Splunk Cloud Platform administrators, the Archive Management panel in the Cloud Monitoring Console (CMC) app shows information about your archived data for indexes that are enabled with Dynamic Data Active Archive (DDAA). Review the information to ensure that you are staying within your subscribed limits for data ingestion and retention. The displayed data updates every time you access or refresh the panel in the CMC app.

Note: Your organization must have enabled DDAA as part of its Splunk Cloud Platform subscription to see data in this panel.

If you exceed your storage requirements by ingesting more data than your initial estimate, Splunk Cloud Platform service elastically expands the amount of storage to retain your data per your retention settings. Periodically, Splunk will review and charge your account for any overages. For more information and to understand storage requirements based on your subscription type, see the Storage section of the Splunk Cloud Platform Service Description.

Archive Summary

In CMC, select the Archive Management link in the first panel of the Storage Summary or Archive Storage (DDAA) dashboard, then select the Archive Summary tab.

The summary information in this tab shows data on the usage, entitlement, and 90-day growth and expiration in GB for all of your deployment's indexes enabled with DDAA.

The archived data details table lists the following information:

  • Archived index name
  • Current size (GB)
  • Timestamps for the earliest and latest archived events
  • 90-day data growth and expiration data in GB

Note: The amounts for the summarized and detailed growth and expiration data are for uncompressed (raw) data.

Interpret these results

Compare the usage against the entitlement and the growth against the expiration. If the usage and the growth consistently exceed the entitlement and the expiration, this indicates the following:

  • You must re-evaluate your index ingestion and retention settings. See the topics listed in the See also section on how to manage indexes and DDAA settings.
  • You may need to upgrade your subscription to better handle your true data ingest and retention rates. Contact your Splunk account representative for help.

Restoration Summary

In CMC, select the Archive Management link in the first panel of the Storage Summary or Archive Storage (DDAA) dashboard, then select the Restoration Summary tab.

The information in this tab shows the restoration activity for all of your deployment's indexes that are enabled with the DDAA feature. These totals in GB show the amount of uncompressed (raw) data in the following categories:

  • Restored: Copied archive data that has been temporarily restored to an index. Restored data expires from searchable storage after 30 days.
  • Cleared: Restored data that has been manually removed from an index. This data has a Jobstatus of Cleared.
  • Expired: Data that has been automatically removed from searchable storage as it has passed the 30-day retention period. This data has a Jobstatus of Expired.

The displayed totals depend on the data you have selected to restore or clear and also the conditions and limitations of the restoration process, as follows:

  • The archival and restoration process is complete.
  • The data doesn't overlap with other data.
  • The data size doesn't cause performance issues.

For more information, see the following in the the Splunk Cloud Platform Admin Manual:

Interpret these results

Review these totals and determine if the amount of data restored, cleared, and expired in your deployment meets or exceeds your organization's actual requirements. For example, a high total for restored data or low total for cleared or expired data may indicate the need to re-evaluate your index management policies and procedures. Ensure that you are restoring and retaining only the data that your organization truly needs.

See also

For more information about See
Managing your aged ingested data with DDAA Store expired Splunk Cloud Platform data to a Splunk-managed archive
Managing indexes Manage Splunk Cloud Platform indexes in the Splunk Cloud Platform Admin Manual