https://community.splunk.com/t5/Getting-Data-In/send-log-to-bucket-s3/m-p/680327#M113674 <P>Indexers will automatically copy buckets from local storage to SmartStore/S3 when they roll from hot to warm.&nbsp; You can try to tune the hot bucket lifetime to 30 days, but I don't recommend it.&nbsp; Let them roll normally and size your SmartStore cache so it's large enough to hold 30 days' of data.</P><P>Use the frozenTimePeriodInSecs setting in indexes.conf to specify the lifetime of the data.&nbsp; Buckets will be removed from S3 when the newest event in the bucket is older than the specified time.</P> Mon, 11 Mar 2024 20:20:03 GMT richgalloway 2024-03-11T20:20:03Z https://community.splunk.com/t5/Getting-Data-In/send-log-to-bucket-s3/m-p/680314#M113673 <P>hello all,</P><P>I would need the logs to be sent to my S3 bucket smartstorage after 1 month from my security index, but they should still be accessible for another 5 months.</P> Mon, 11 Mar 2024 17:27:25 GMT https://community.splunk.com/t5/Getting-Data-In/send-log-to-bucket-s3/m-p/680314#M113673 toporagno 2024-03-11T17:27:25Z https://community.splunk.com/t5/Getting-Data-In/send-log-to-bucket-s3/m-p/680327#M113674 <P>Indexers will automatically copy buckets from local storage to SmartStore/S3 when they roll from hot to warm.&nbsp; You can try to tune the hot bucket lifetime to 30 days, but I don't recommend it.&nbsp; Let them roll normally and size your SmartStore cache so it's large enough to hold 30 days' of data.</P><P>Use the frozenTimePeriodInSecs setting in indexes.conf to specify the lifetime of the data.&nbsp; Buckets will be removed from S3 when the newest event in the bucket is older than the specified time.</P> Mon, 11 Mar 2024 20:20:03 GMT https://community.splunk.com/t5/Getting-Data-In/send-log-to-bucket-s3/m-p/680327#M113674 richgalloway 2024-03-11T20:20:03Z