https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546436#M5456 <UL><LI>Hmm so it doesn’t look like there’s an easy way for us to automatically copy over the frozen logs directly to the ceph s3 bucket?&nbsp;<BR /><BR /></LI></UL><P>Do you have any ideas on how we can write a script to copy over frozen buckets over to ceph s3 buckets?&nbsp;</P> Thu, 01 Apr 2021 20:47:46 GMT splunkuser109 2021-04-01T20:47:46Z https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546424#M5453 <P>How can we automatically send frozen/archived splunk logs from the indexers over to a Ceph S3 bucket using the indexers.conf file on the indexers?&nbsp;</P> Thu, 01 Apr 2021 19:20:45 GMT https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546424#M5453 splunkuser109 2021-04-01T19:20:45Z https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546431#M5455 <P>Yes, sort of.&nbsp; Use indexers.conf to specify a coldToFrozenScript.&nbsp; That script, which you must write, will copy the archived buckets to Ceph.&nbsp; See&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.1.3/Indexer/Automatearchiving" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.3/Indexer/Automatearchiving </A>and&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/Indexesconf#PER_INDEX_OPTIONS" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/Indexesconf#PER_INDEX_OPTIONS</A></P> Thu, 01 Apr 2021 20:12:20 GMT https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546431#M5455 richgalloway 2021-04-01T20:12:20Z https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546436#M5456 <UL><LI>Hmm so it doesn’t look like there’s an easy way for us to automatically copy over the frozen logs directly to the ceph s3 bucket?&nbsp;<BR /><BR /></LI></UL><P>Do you have any ideas on how we can write a script to copy over frozen buckets over to ceph s3 buckets?&nbsp;</P> Thu, 01 Apr 2021 20:47:46 GMT https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546436#M5456 splunkuser109 2021-04-01T20:47:46Z https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546462#M5458 <P>Personally, I like Visual Studio Code, but notepad++ is good, too.&nbsp;&nbsp;<span class="lia-unicode-emoji" title=":grinning_face:">😀</span></P> Fri, 02 Apr 2021 00:42:44 GMT https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546462#M5458 richgalloway 2021-04-02T00:42:44Z https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546463#M5459 <P>hahaha. Can remotePath (ceph s3 bucket) not be used to store the cold or frozen buckets/logs?&nbsp;</P><P>&nbsp;</P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Indexesconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Indexesconf</A></P> Fri, 02 Apr 2021 03:03:22 GMT https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546463#M5459 splunkuser109 2021-04-02T03:03:22Z https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546527#M5464 <P>remotePath is used for warm/cold buckets.&nbsp; This is part of the SmartStore feature.&nbsp; Frozen buckets are different and are not stored by SmarStore.</P><P>There is an example coldToFrozenScript in $SPLUNK_HOME/bin.</P> Fri, 02 Apr 2021 12:23:34 GMT https://community.splunk.com/t5/Splunk-Enterprise/Send-Splunk-Archive-Logs-to-Ceph-S3/m-p/546527#M5464 richgalloway 2021-04-02T12:23:34Z