topic Re: How can we manually archive data one time while meeting compliance requirements? in Getting Data In

How can we manually archive data one time while meeting compliance requirements?

AshleighS — Wed, 29 Nov 2017 18:20:41 GMT

Hi, can any one please help me find documentation / instructions that explain very simply how I can archive our Splunk data based on a date range (IE from 1 May 2016 to 13 November 2017) just one time? I see how I can change the conf files in two different ways to automate archiving, but we do not want to set that up; it would not suit our compliance requirements. We just need to archive this chunk of data just this one time.

We have two splunk indexers in our indexer cluster.

Your help is greatly appreciated, thank you!

Re: How can we manually archive data one time while meeting compliance requirements?

iandrews_splunk — Thu, 30 Nov 2017 14:01:00 GMT

Searching the time range, from a search head, then exporting the results to a mounted share might work for you.

Re: How can we manually archive data one time while meeting compliance requirements?

DalJeanis — Thu, 30 Nov 2017 15:17:50 GMT

This is a perfect use case for just using collect to a summary index. You are not really summarizing anything, but the strategy would work. Set the summary index to move to cold and freeze quickly (in a few days) and then copy the frozen buckets to your permanent storage/retention method. You will know the data is there, and you can validate that the amount of data is right, do quick reporting and analysis from your summary index beforehand to make sure that the data is safely present, and so on, before the buckets roll to frozen.

Re: How can we manually archive data one time while meeting compliance requirements?

woodcock — Tue, 05 Dec 2017 03:30:47 GMT

This is the "standard line":
http://docs.splunk.com/Documentation/Splunk/latest/Search/Exportsearchresults

But if you are hard-core and like to live dangerously or need more direct control, you can take the red pill:
https://answers.splunk.com/answers/181466/what-is-recommended-on-moving-select-data-in-the-d.html
It starts with /opt/splunk*/bin/splunk cmd exporttool help.