Can you help me archive Splunk data from an indexer cluster?

[lwass]

Hello,

I have a Splunk Indexer cluster. The cluster consists of 3 peer nodes, with a replication factor of 3.

My issues are surrounding freezing off old log data.

1. I need to be able to archive off old logs. The documentation does not give a definitive way to do this with a clustered environment. I would think that since I have a replication factor of 3, each indexer has a complete copy of all the data, and therefore, I would only need to freeze data from one peer node.

2. If the observation in point 1 is correct, since all configuration should be the same between indexers in a cluster, I don't think I can use the native Splunk config for archiving log data (or can I)?

3. How have others handled this?

Does anyone have any advice on how to best proceed?

Cheers!

[chrisyounger]

Splunk is smart enough to know its in a cluster and only the "primary" copy of the bucket will be archived. So you don't need to worry about it. Just configure it the same as a non-clustered environment.

All the best.