Deployment Architecture
Highlighted

Storing logs in a datacenter

Engager

I need to store logs for a year and I cant reasonably store it all on the computer I installed Splunk on. Is there a way to keep the raw logs stored on a data center? I want to buy a 4 gig storage device to store everything on. It is not an actual computer, just data storage.

Tags (3)
0 Karma
Highlighted

Re: Storing logs in a datacenter

Super Champion

Do you want to be able to search the data that is stored in the datacenter? Or, are you looking to save the data in case you need to search it later?

0 Karma
Highlighted

Re: Storing logs in a datacenter

Ultra Champion

The data has to be indexed on the indexers at one point. And written to disk in buckets in indexes folders.
Each bucket represent events for a given timerange.
the lifetime of a bucket is HOT -> WARM -> COLD (not always)
then deleted or archived -> FROZEN
then restored -> THAWED
see http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/HowSplunkstoresindexes

The HOT/WARM/COLD/THAWED buckets present on the indexers are searchable.
When a bucket became frozen it's deleted by default, but instead deleting them, you could setup a policy to archive them on another storage (mount, backup, aws, etc...) .
and when needed copy them back as THAWED on the indexers to make them searchable again on them.

see the parameters : coldToFrozenDir
and the retention policies
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

Highlighted

Re: Storing logs in a datacenter

Engager

Thanks! I will read the info and see if I can make sense of it all.

0 Karma