splunk-ddaa-archive

To set per-index archive retention in Splunk Cloud, you render DDAA payloads defining searchableDays and splunkArchivalRetentionDays, then apply them via the ACS API using the enable-ddaa.sh script to manage compliant long-term data storage.

DDAA (Dynamic Data Active Archive) and DDSS are distinct retention tiers in Splunk Cloud. DDAA enables searchable archived data with controlled restoration via ACS API payloads, whereas the Skill specifically renders and audits DDAA lifecycle assets to ensure compliant long-term storage.

To restore archived Splunk Cloud data for searching, you use a guided UI restore handoff process. The Skill provides a safe, render-first workflow with restore.sh to validate and manage the restoration of archived buckets back to an active searchable state.

Yes, you can audit archived and restored storage consumption for Splunk Cloud indexes. The Skill provides audit.sh status tooling to inspect current retention configurations, archived data volumes, and restored buckets to ensure controlled data lifecycle management.

The safest way to update DDAA retention settings without direct data loss is using a render-first workflow. This approach preflights and validates Splunk Cloud Platform lifecycle assets before applying changes, ensuring archive configurations are compliant before activation.

Yes, you need Splunk Cloud Platform to use the splunk-ddaa-archive Skill because it relies on the ACS API to render and manage Dynamic Data Active Archive lifecycles. It is specifically designed for per-index archive retention, enabling, and auditing within Splunk Cloud.