Cannot create index or change the searchable retention period of an index

Applicability

Description

Not able to modify the searchable retention period for any index, getting the below error:

This configuration task could not be completed due to one or more critical error during configuration validation
*["Critical"]archiver.coldStorageRetentionPeriod must be greater than frozenTimePeriodSecs for index=cim_modactions']
To resolve this issue,contact splunk support.

Investigation

The error is triggered because the index has coldStorageRetentionPeriod (archive retention) equal to frozenTimePeriodInSecs (searchable retention) for example 365 days. From Splunk Cloud version 9.0.2303 or later, Splunk has implemented validation to enforce searchable retention is less than the archive retention when Dynamic Data Active Archive (DDAA) is enabled. If you increase the archive retention period for the cim_modactions index, it should unblock all other index changes.

Resolution

1. Increase archive retention period for cim_modactions index so searchable retention is less than archive retention.
2. Now, change searchable retention for any other index, as long as searchable is less than archive.

Related Links

Setting data retention rules in Splunk Cloud Platform

Manage Splunk Cloud Platform indexes