https://community.splunk.com/t5/Deployment-Architecture/Backup-question/m-p/23325#M548 <P>The data is stored in buckets per index.<BR /> And each bucket has his timerange in the folder name in epoch time.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/HowSplunkstoresindexes">http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/HowSplunkstoresindexes</A></P> <P>It should not be difficult to write a script that will backup selectively all the buckets that contains any events more recent than 2 months ago.</P> <P>PS: the hot buckets cannot be reliably copied because they are intensively written. A technique is to force them to roll to warm just before the backup.</P> Mon, 05 Nov 2012 15:16:36 GMT yannK 2012-11-05T15:16:36Z https://community.splunk.com/t5/Deployment-Architecture/Backup-question/m-p/23324#M547 <P>Hi, I was wondering, is it possible to backup the last 2 months of indexed information?</P> Mon, 05 Nov 2012 14:56:04 GMT https://community.splunk.com/t5/Deployment-Architecture/Backup-question/m-p/23324#M547 christinmb 2012-11-05T14:56:04Z https://community.splunk.com/t5/Deployment-Architecture/Backup-question/m-p/23325#M548 <P>The data is stored in buckets per index.<BR /> And each bucket has his timerange in the folder name in epoch time.<BR /> see <A href="http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/HowSplunkstoresindexes">http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/HowSplunkstoresindexes</A></P> <P>It should not be difficult to write a script that will backup selectively all the buckets that contains any events more recent than 2 months ago.</P> <P>PS: the hot buckets cannot be reliably copied because they are intensively written. A technique is to force them to roll to warm just before the backup.</P> Mon, 05 Nov 2012 15:16:36 GMT https://community.splunk.com/t5/Deployment-Architecture/Backup-question/m-p/23325#M548 yannK 2012-11-05T15:16:36Z