Dynamic Data Active Archive (DDAA) lets you move your data from your Splunk Cloud Platform indexes to a Splunk-maintained archive. You can use DDAA to maintain access to older data for compliance purposes. You specify archiving at the index level by creating an archiving rule for a specified index. This give you the flexibility to archive only the specific data that you need to maintain.
You can configure Splunk Cloud Platform to automatically archive the data from an index when the data either reaches a specified maximum size or the end of the Splunk Cloud Platform searchable retention period for an index. You can restore archived data to your Splunk Cloud Platform environment for searching within the configured archival retention time period.
You can manually clear restored data or let it auto-expire from searchable storage after 30 days. You can also track archived and restored data storage consumption, as well as the growth and expiration of your archived data.
Dynamic Data Active Archive moves data from your Splunk Index to a Splunk-maintained archive, and subsequently back from the Splunk-maintained archive to the Splunk Index in a secure and tamper-resistant manner.
