All Apps and Add-ons

Can we integrate AWS S3 with our premise Splunk installation for non-hot data?


We are running Splunk on premise using bare metal servers with local disk. The amount of disk space locally is limited so we can only now store a limited amount of data in terms of time. We would like to expand the amount of data we are indexing over time so we can look at historical trends, etc. Has anyone ever used AWS S3 (or similar) to store data beyond the "hot" tier (i.e. medium, color, frozen)?

Tags (3)


One approach is to use open source log management tools like Fluentd so that you can unify and simplify your logging layer. Using the output plugins for Splunk and Amazon S3, you can send same data to both Splunk and S3. You can learn more about Fluentd and its enterprise offering below:

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...