Splunk Smartstore to on-prem S3 then tier to public cloud

[cfrank]

Hi all,

My customer would like to use Smartstore with on prem S3 storage(Storagegrid) and then tier the older data(after 3 years) to AWS vis Storagegrid's Cloud Storage Pools. Is this supported?

TIA,
Frank

[richgalloway]

The only way to do that in a supported fashion is to put warm data in SmartStore and frozen data in AWS.  Frozen data can be put anywhere you wish using coldToFrozenScript.  Splunk doesn't care (or know) about your frozen data.

[cfrank]

Thanks for the quick reply. Sorry, I am not that familiar with the architecture. Splunk sends the data from the indexers(hot tier) to S3. Is S3 what you mean by Smartstore below? S3 is considered warm according to the diagram here.

You would then be able to use the coldtoFrozen script on the older data to send it from on prem S3 to AWS? So it goes to AWS just not by tiering it.