Deployment Architecture
Highlighted

How do I save data when moving from warm to cold buckets?

Engager

Hi,

I want to figure out a way to backup the Splunk data when the index is transferring from a Warm bucket to a cold bucket. Preferably I would like a trigger to back up all the stuff in the warm bucket when it's about to be moved to a cold bucket.

Tags (3)
0 Karma
Highlighted

Re: How do I save data when moving from warm to cold buckets?

Splunk Employee
Splunk Employee

The first thought, that comes to mind, is to use rsync on a cron schedule that a little aggressive so you can make sure that you aren't ever missing any buckets.

rsync -a -v --ignore-existing src dst

-a archive mode
-v verbose mode
--ignore-existing skip updating files (since warm buckets are read only anyways)

This will allow you to copy to remote location - rsync will check to see if there are buckets that haven't been copied, and if they aren't, it will copy them.

To be honest though, this is just an idea. I'm sure there are lots of ways to do this.

0 Karma
Highlighted

Re: How do I save data when moving from warm to cold buckets?

SplunkTrust
SplunkTrust

Any specific reason to save the warm buckets?

0 Karma