@richgalloway wrote: Do NOT use lifecycle policies for SmartStore buckets.  Allow Splunk to manage the data itself.  Data moved to Glacier will not be searchable by Splunk. If you want to archive your old data then you can use the coldToFrozenScript setting to copy the data to a different S3 bucket which you manage.  See https://community.splunk.com/t5/Getting-Data-In/Splunk-SmartStore-Do-warm-buckets-need-to-roll-to-frozen/m-p/461005 for a good discussion of how to do that.  OK, but why "Data moved to Glacier will not be searchable by Splunk." ? Are there any changes in indexed data that justifies it not being restored later or something like that? In this case I had this kind of problem, although I'm not sure if it is related or not to my Glacier/S3 lifecycle disaster recover policies transitioning ("copying") data into cold storage.  If someone has had this issue or can comment on any conflicts observed regarding smartstore and glacier, I would really appreciate it. ... View more