archiving

verb

The action of adding to and maintaining a collection of historical data. In Splunk, you define archiving policy based on your organization's needs. You can specify that indexed data be archived when an index reaches a certain size or age.

For more information

In the Admin Manual:

configuration

configuration file

event processing

character set encoding

segmentation

segment

timestamping

timestamp, timezone offset

default field extraction

host, source, source type, punct


archiving

retention time