Backing up hot buckets on NetApp

[Branden]

According to the documentation:
"To back up hot buckets as well, you need to take a snapshot of the files, using a tool like VSS (on Windows/NTFS), ZFS snapshots (on ZFS), or a snapshot facility provided by the storage subsystem. If you do not have a snapshot tool available, you can manually roll a hot bucket to warm and then back it up, as described below. However, this is not generally recommended, for reasons also discussed below. "

We will be moving our Splunk storage to our NetApp, which employs a product we purchased called SnapDrive. I don't know too much about it, but, among other things, it allows us to take snap shots of our data for quick back-ups/restores. (Our storage team manages this stuff, fortunately.)

Does anyone have any experience with this product/procedure? Would this be a suitable substitute for rolling hot buckets->warm buckets then doing incrementals?

Thanks!

[dwaddle · Accepted solution]

I assume since you are using SnapDrive, this is a NetApp connected via FCP or iSCSI and not NFS. Splunk does not recommend use of NFS for hot buckets.

SnapDrive snapshots should be sufficient for backing up hot buckets.

Also, Splunk 4.2 includes changes that make hot bucket recovery more reliable. So, while using SnapDrive snapshots for your backups should be good enough, also having your indexers on Splunk 4.2 should add some additional confidence.