I have a couple midsize Splunk environments setup in aws (3 indexers/1search head/1 heavy forwarder/1 master) Does anyone have a guide on the best process to use for an AMI refresh? Our current process (Inherited) suffers from data loss using snapshots of the vols used to store the data. I need to resolve this before the next refresh.
