topic Re: Rolling cold data to tape in Getting Data In

Rolling cold data to tape

preotesoiu — Fri, 28 Jul 2017 00:35:57 GMT

Hello,
We are planning for a solution to archive cold data to tape and I was wondering which one of these solutions will be better (coldToFrozenDir or coldToFrozenScript).
Initial plan was to use coldToFrozenDir into a separate volume and then have Tivoli Storage Manager to move it to tape but reading through Splunk documentation it appears that coldToFrozenScript is preferred when rolling to tape.
Have you implemented such a solution and what would be the conditions that have to be met in order to have a successful implementation?

Re: Rolling cold data to tape

inventsekar — Fri, 28 Jul 2017 01:19:04 GMT

coldToFrozenScript is the best option as per my view.
- (instead of using coldToFrozenDir and then Tivoli Storage Manager to write to tape, you could directly do this with coldToFrozenScript)
- the cost of Tivoli Storage Manager
- extra configuration and maintenance works, etc..

between, how much data, approx you have or daily license limit please.

Re: Rolling cold data to tape

preotesoiu — Fri, 28 Jul 2017 01:29:36 GMT

Thanks.
We are doing several TB daily ingestion.
By the way, do you know if the script will take care of replicated buckets or if that is something we need to consider?

Re: Rolling cold data to tape

s2_splunk — Fri, 28 Jul 2017 19:54:11 GMT

It will not. Data rolls individually per indexer, so if you are running index replication, you may want to remove all replicated buckets and only move primaries in your script.

Re: Rolling cold data to tape

preotesoiu — Fri, 28 Jul 2017 20:01:06 GMT

much appreciated! I have what I need for now to start testing...
G