https://community.splunk.com/t5/Getting-Data-In/Automatically-archive-windows-event-logs-from-interface/m-p/21940#M3324 <P>AFAIK there is no such functionality present in the web interface, the coldToFrozenScript is the way to go.</P> Thu, 13 Jan 2011 20:40:58 GMT Ayn 2011-01-13T20:40:58Z https://community.splunk.com/t5/Getting-Data-In/Automatically-archive-windows-event-logs-from-interface/m-p/21939#M3323 <P>Due to our strict security policies I need to show a security representative that Splunk can not only index windows event logs but also archive them to a directory.</P> <P>I know I can set this up for automation via the coldToFrozenScript field in indexes.conf, but I was wondering if there was a way to add this functionality to the user interface so that I could simply click on a link and go to a backup directory and view the newly archived file.</P> <P>Thanks for your time.</P> <P>Steve</P> Fri, 07 Jan 2011 00:40:45 GMT https://community.splunk.com/t5/Getting-Data-In/Automatically-archive-windows-event-logs-from-interface/m-p/21939#M3323 sgramenopoulos 2011-01-07T00:40:45Z https://community.splunk.com/t5/Getting-Data-In/Automatically-archive-windows-event-logs-from-interface/m-p/21940#M3324 <P>AFAIK there is no such functionality present in the web interface, the coldToFrozenScript is the way to go.</P> Thu, 13 Jan 2011 20:40:58 GMT https://community.splunk.com/t5/Getting-Data-In/Automatically-archive-windows-event-logs-from-interface/m-p/21940#M3324 Ayn 2011-01-13T20:40:58Z