Backup question

[christinmb]

Hi, I was wondering, is it possible to backup the last 2 months of indexed information?

[yannK · Accepted solution]

The data is stored in buckets per index.
And each bucket has his timerange in the folder name in epoch time.
see http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/HowSplunkstoresindexes

It should not be difficult to write a script that will backup selectively all the buckets that contains any events more recent than 2 months ago.

PS: the hot buckets cannot be reliably copied because they are intensively written. A technique is to force them to roll to warm just before the backup.