https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254462#M48857 <P>What strategies do people use for backups of their buckets? Is there a clean way to identify "new" buckets for a given day based on their file name? </P> Thu, 26 Jan 2017 15:03:08 GMT pdoconnell 2017-01-26T15:03:08Z https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254462#M48857 <P>What strategies do people use for backups of their buckets? Is there a clean way to identify "new" buckets for a given day based on their file name? </P> Thu, 26 Jan 2017 15:03:08 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254462#M48857 pdoconnell 2017-01-26T15:03:08Z https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254463#M48858 <P>If you have an Hadoop cluster, you might consider Hunk for a full backup solution - <A href="https://answers.splunk.com/answers/411055/is-there-a-solution-to-back-up-splunk-data-into-hd.html">Is there a solution to back up Splunk data into HDFS to make it available for search via Hunk?</A></P> Thu, 26 Jan 2017 15:50:15 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254463#M48858 ddrillic 2017-01-26T15:50:15Z https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254464#M48859 <P>Splunk recommends snapshot technology to backup buckets. Due to hot buckets being written to, you should consider not backing them up via snapshots, as you may miss data. Apart from that, snapshotting all the other buckets is recommended (warm, cold, ...).</P> <P>Every bucket follows a naming convention with two timestamps (newest and oldest time):<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/HowSplunkstoresindexes#Bucket_naming_conventions">http://docs.splunk.com/Documentation/Splunk/6.5.1/Indexer/HowSplunkstoresindexes#Bucket_naming_conventions</A></P> <P>Did that answer your question?</P> <P>Skalli</P> Thu, 26 Jan 2017 16:34:49 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254464#M48859 skalliger 2017-01-26T16:34:49Z https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254465#M48860 <P>The documentation recommends doing incremental backups of warm buckets, see <A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Indexer/Backupindexeddata">Back up indexed data</A> in the <EM>Managing Indexers and Clusters of Indexers</EM> manual. As skalliger mentions in his answer, the bucket names do indicate the age of the data they contain.</P> Thu, 26 Jan 2017 18:06:17 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254465#M48860 ChrisG 2017-01-26T18:06:17Z https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254466#M48861 <P>Snapshot makes you get you data backed up for your instant point of time data. So very reason, Splunk recommends to have resiliency to be maintained, in case to protect data</P> Wed, 15 Feb 2017 01:19:04 GMT https://community.splunk.com/t5/Getting-Data-In/What-are-good-backup-strategies-for-indexer-buckets/m-p/254466#M48861 anand_singh17 2017-02-15T01:19:04Z