Deployment Architecture

Need a little help - how to move cold storage data to warm and warm to cold?

Log_wrangler
Builder

I have not done this before and I am not sure what the best way to move older data in to the warm buckets?

The objective is to move the older data to the faster drives back in the hot/warm buckets.

IF you could provide an example that would be great.

Any advice or reference is appreciated. The environment is 6.3 or higher.
Thank you

Tags (3)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

The index storage will have separate folders for hot/warm buckets (default location $Splunk_Home/var/lib/splunk/IndexNameHere/db) and cold buckets (default location $Splunk_Home/var/lib/splunk/IndexNameHere/colddb). Assuming your IndexNameHere/db is hosted in faster drive already, do you want to host IndexNameHere/colddb also in same faster drive?

0 Karma

Log_wrangler
Builder

Thank you somesoni2, yes as you stated its a simple linux directory move that I am dealing with. I thought it was more complicated. Please convert your reply to answer and I will accept. Thank you

0 Karma

Log_wrangler
Builder

Thank somesoni2, I have not had a chance to see the architecture yet, just trying to get prepared and understand the process.

0 Karma

Log_wrangler
Builder

the request is to move the old data back to the fast drive temporarily.... thx

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...