topic Re: Can I move cold data from a current index into a S3 bucket in Knowledge Management

Can I move cold data from a current index into a S3 bucket

ed07net_YG — Thu, 10 Feb 2022 14:41:49 GMT

Hi Community,

I need to move current data from one of my indexes into an S3 bucket. Is that possible?

I read about the SmartStore feature. However, I need to move the data into another location after the index reaches a particular size.

The problem is that I have an index growing up like crazy. I need to have the data available for at least one year and be able to perform searches for at least six months. And of course, local storage is too expensive.

So, I am getting confused here on what would be the best approach to follow since that's the only index causing me issues.

In 60 days, I got around 300GB of data.

Thanks,

Re: Can I move cold data from a current index into a S3 bucket

richgalloway — Sun, 30 Jan 2022 15:05:55 GMT

First, don't mess with indexes behind Splunk's back. Unhappiness may ensue.

SmartStore can be enabled for a single index. However, you should use S3 for SmartStore only if your indexers already are in AWS. Otherwise, the data egress charges could be prohibitive.

Re: Can I move cold data from a current index into a S3 bucket

VatsalJagani — Thu, 10 Feb 2022 06:26:55 GMT

You can move only that index to S3. But because there is no concept of warm/cold when using SmartStore/S3 you will be migrating the full index to S3. (Splunk will take care of caching and all.)