Archiving Indexers to AWS S3: Is there is anyone who has experience with setting up this configuration?

[LWillson]

Hello,

We have a fairly new Splunk Enterprise implementation behind us and are trying to figure out a way to archive our data buckets (Cold) into frozen buckets, as we are running out of space in our main search indexer. We have read through the Splunk documentation, and believe that we will want to use coldToFrozenDir to set up the path.

We are thinking about archiving the data to either AWS S3 buckets or Glacier. Is there is anyone who has experience with setting up this configuration or who has some guidance?

Will we need to use Hadoop in order to use AWS S3 buckets for archiving our Splunk data or can we go without? How do we set up the path to push the Splunk data to AWS?

[rdagan_splunk]

I have not tried Glacier, but yes S3 works.
Have you considered Splunk Hadoop Data Roll?
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/ArchivingSplunkindexestoS3
and
https://answers.splunk.com/answers/457052/how-to-configure-650-data-roll-to-search-archived.html