All Apps and Add-ons
Highlighted

Archiving Indexers to AWS S3: Is there is anyone who has experience with setting up this configuration?

New Member

Hello,

We have a fairly new Splunk Enterprise implementation behind us and are trying to figure out a way to archive our data buckets (Cold) into frozen buckets, as we are running out of space in our main search indexer. We have read through the Splunk documentation, and believe that we will want to use coldToFrozenDir to set up the path.

We are thinking about archiving the data to either AWS S3 buckets or Glacier. Is there is anyone who has experience with setting up this configuration or who has some guidance?

Will we need to use Hadoop in order to use AWS S3 buckets for archiving our Splunk data or can we go without? How do we set up the path to push the Splunk data to AWS?

0 Karma
Highlighted

Re: Archiving Indexers to AWS S3: Is there is anyone who has experience with setting up this configuration?

Splunk Employee
Splunk Employee
0 Karma