topic Re: How to get a copy of Splunk Cloud information ? in Splunk Cloud Platform

How to get a copy of Splunk Cloud information ?

splunkcol — Sat, 11 Feb 2023 17:29:11 GMT

Our client is asking us for information that is stored in the Splunk cloud, and I am not aware of how to access a copy of the information, either because they simply want to have it or because they want it to be backed up from time to time.

The second part of the question is if there is such a way to have a copy of that information how is the restore process?

Re: How to get a copy of Splunk Cloud information ?

richgalloway — Sat, 11 Feb 2023 17:31:04 GMT

What information does the client want? Some may be available via the UI, but most will have to come from Support. Other information may not be available at all.

Be aware the Splunk Cloud makes regular backups of each stack.

Re: How to get a copy of Splunk Cloud information ?

splunkcol — Sat, 11 Feb 2023 17:50:57 GMT

One of the data sources is from a database that is being sent to Splunk is what is collected via the dbconnect plugin.

Re: How to get a copy of Splunk Cloud information ?

richgalloway — Sat, 11 Feb 2023 22:20:25 GMT

Data ingested using DBX is indexed. You should be able to run a search and export the results. That's probably the best you can do as I doubt Splunk will give you a copy of the buckets.