Storing logs in a datacenter

[superzeeman]

I need to store logs for a year and I cant reasonably store it all on the computer I installed Splunk on. Is there a way to keep the raw logs stored on a data center? I want to buy a 4 gig storage device to store everything on. It is not an actual computer, just data storage.

[yannK]

The data has to be indexed on the indexers at one point. And written to disk in buckets in indexes folders.
Each bucket represent events for a given timerange.
the lifetime of a bucket is HOT -> WARM -> COLD (not always)
then deleted or archived -> FROZEN
then restored -> THAWED
see http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/HowSplunkstoresindexes

The HOT/WARM/COLD/THAWED buckets present on the indexers are searchable.
When a bucket became frozen it's deleted by default, but instead deleting them, you could setup a policy to archive them on another storage (mount, backup, aws, etc...) .
and when needed copy them back as THAWED on the indexers to make them searchable again on them.

see the parameters : coldToFrozenDir
and the retention policies
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

[superzeeman]

Thanks! I will read the info and see if I can make sense of it all.

[lukejadamec]

Do you want to be able to search the data that is stored in the datacenter? Or, are you looking to save the data in case you need to search it later?