All Apps and Add-ons

Archiving Indexers to AWS S3: Is there is anyone who has experience with setting up this configuration?

LWillson
New Member

Hello,

We have a fairly new Splunk Enterprise implementation behind us and are trying to figure out a way to archive our data buckets (Cold) into frozen buckets, as we are running out of space in our main search indexer. We have read through the Splunk documentation, and believe that we will want to use coldToFrozenDir to set up the path.

We are thinking about archiving the data to either AWS S3 buckets or Glacier. Is there is anyone who has experience with setting up this configuration or who has some guidance?

Will we need to use Hadoop in order to use AWS S3 buckets for archiving our Splunk data or can we go without? How do we set up the path to push the Splunk data to AWS?

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...