Deployment Architecture

Can you help me archive Splunk data from an indexer cluster?



I have a Splunk Indexer cluster. The cluster consists of 3 peer nodes, with a replication factor of 3.

My issues are surrounding freezing off old log data.

  1. I need to be able to archive off old logs. The documentation does not give a definitive way to do this with a clustered environment. I would think that since I have a replication factor of 3, each indexer has a complete copy of all the data, and therefore, I would only need to freeze data from one peer node.

  2. If the observation in point 1 is correct, since all configuration should be the same between indexers in a cluster, I don't think I can use the native Splunk config for archiving log data (or can I)?

  3. How have others handled this?

Does anyone have any advice on how to best proceed?


0 Karma


Splunk is smart enough to know its in a cluster and only the "primary" copy of the bucket will be archived. So you don't need to worry about it. Just configure it the same as a non-clustered environment.

All the best.

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...