How do I save data when moving from warm to cold buckets?

[jananth1]

Hi,

I want to figure out a way to backup the Splunk data when the index is transferring from a Warm bucket to a cold bucket. Preferably I would like a trigger to back up all the stuff in the warm bucket when it's about to be moved to a cold bucket.

[somesoni2]

Any specific reason to save the warm buckets?

[aljohnson_splun]

The first thought, that comes to mind, is to use rsync on a cron schedule that a little aggressive so you can make sure that you aren't ever missing any buckets.

rsync -a -v --ignore-existing src dst

-a archive mode
-v verbose mode
--ignore-existing skip updating files (since warm buckets are read only anyways)

This will allow you to copy to remote location - rsync will check to see if there are buckets that haven't been copied, and if they aren't, it will copy them.

To be honest though, this is just an idea. I'm sure there are lots of ways to do this.