splunk-ddaa-archive-setup

To configure per-index DDAA archival retention in Splunk Cloud, you render an ACS policy payload specifying searchable days and archival days for the target index. Explicit approval is required before applying the configuration via ACS.

The Splunk DDAA archival policy payload defines searchable days and archival retention limits for individual indexes. It enforces input constraints and generates artifacts like runbooks and status scripts for validation and rollback.

You generate a restore or disable runbook for Splunk Cloud index archival by rendering the per-index DDAA policy. The workflow produces acs-payload.json, restore-runbook.md, disable-runbook.md, and status.sh for rollback and validation.

Yes, applying Splunk DDAA retention via ACS requires explicit approval to execute. The workflow validates index name, searchable days, and archival days, and provides UI runbook guidance as an alternative to direct ACS application.

When setting DDAA searchable and archival days, the workflow enforces strict input constraints on the index name, searchable days, and archival days. This validates the index state before producing the ACS payload and runbooks.