Data Insight stores system events, alerts, and access events on the Indexer worker node in a pre-determined folder. You can configure Data Insight to automatically archive access events older that the specified interval to another folder to save space. Once the data is archived, it is no longer available for querying. You can, however, restore the data back to the original location on the Indexer node, if needed.

By default, archived data is automatically moved to $data/indexer/archive folder on each Indexer worker node. You can also configure a different archive folder on the Indexer nodes. The archive folder is organized by YEAR/MONTH to make restoring easy. Once data is moved to this folder based on the configured archive policy, you can do one of the following:

If you want to restore archived data at a later time, you must bring back the appropriate segments from the backup folder to their original location in the archive folder and use the indexcli utility to restore these segments. Once restored, segments are not archived or purged by the data retention policy till they are marked for re-archiving.