Backing up is not automated?

michael_lee — Sat, 09 May 2015 15:11:18 GMT

Hi,

What is the standard practice to clear up space ? for example I have configured splunk to receive syslogs everyday. However now my disk space keeps filling up. I want to backup my index (for the syslogs) , truncate data in the index and start afresh. Isn't there a seamless or "automated" way to do index backing up?
thanks

Re: Backing up is not automated?

s2_splunk — Sat, 09 May 2015 21:29:30 GMT

I'd suggest you read through this and familiarize yourself with how Splunk manages index data for you. Data is stored in buckets, which go through multiple stages, namely from HOT (actively written to) to WARM (read-only) to COLD (read-only) to FROZEN (not searchable).
You have full control over how long you keep data in each stage, either by specifying a time period or by limiting how much disk space each stage can consume.

This is fully automatic, but it DOES NOT replace backing up your data, if you are concerned about data loss. Take a gander at this for best practices around backing up your index data and/or consider using index replication to guard against indexer/data loss.

topic Backing up is not automated? in Deployment Architecture

Backing up is not automated?

Re: Backing up is not automated?