https://community.splunk.com/t5/Splunk-Enterprise/What-would-be-the-method-to-retain-data-for-required-time-period/m-p/610022#M13679 <P>It depends on your needs.&nbsp; If the data can be retained in Splunk format then a simple backup of your warm and cold buckets should suffice.&nbsp; When they're needed later, just spin up an indexer, restore the needed buckets to the appropriate "thawed" folder, issue <FONT face="courier new,courier">splunk rebuild</FONT> commands, and restart the indexer.</P> Thu, 18 Aug 2022 19:06:56 GMT richgalloway 2022-08-18T19:06:56Z https://community.splunk.com/t5/Splunk-Enterprise/What-would-be-the-method-to-retain-data-for-required-time-period/m-p/610012#M13678 <P>We have data on a Splunk instance that needs to be retained for audit purposes. The new instance owner will not allow the old data to be ingested. What would be method to retain data for required time period without retaining old instance?</P> Thu, 18 Aug 2022 19:04:17 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-would-be-the-method-to-retain-data-for-required-time-period/m-p/610012#M13678 jdavis 2022-08-18T19:04:17Z https://community.splunk.com/t5/Splunk-Enterprise/What-would-be-the-method-to-retain-data-for-required-time-period/m-p/610022#M13679 <P>It depends on your needs.&nbsp; If the data can be retained in Splunk format then a simple backup of your warm and cold buckets should suffice.&nbsp; When they're needed later, just spin up an indexer, restore the needed buckets to the appropriate "thawed" folder, issue <FONT face="courier new,courier">splunk rebuild</FONT> commands, and restart the indexer.</P> Thu, 18 Aug 2022 19:06:56 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-would-be-the-method-to-retain-data-for-required-time-period/m-p/610022#M13679 richgalloway 2022-08-18T19:06:56Z