Deployment Architecture

When backing up frozen data with Replication factor, is the rb_* needed?

ndoerfler
Engager

I have set a frozen path and need to keep data that has been frozen for a certain amount of time. Due to space restrictions, this needs to be moved to an NFS mount and backed up there, then cleared from the frozen path location.

Since it's a replication of 3, i found it silly that i was asked to back up 3 copies of the same data. I was under the assumption that i can backup just the db_ and not need to backup the rb_ files since everything needed for restore can be done by bringing back the db_ and going through the normal restoration process.

Is there a reason as to why i should keep both or 1 copy of the rb_ if i'm already backing up the db_ directories?

Any help is appreciated, thank you!

0 Karma
1 Solution

prakash007
Builder

It depends upon what's your approach in case you need to thaw the archived/frozen data..
-you might need all copies if you are following this process..
https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Restorearchiveddata#Clustered_data_thawin...

-in our case we just keep db_*(which has tsidx and raw data) in our NFS, and then we thaw/rebuild them on a stand-alone indexer(add it as a search peer to the search-head), so that we won't interrupt any cluster functionality ..read this splunk answer for more details..
https://answers.splunk.com/answers/635561/how-do-i-thaw-frozen-buckets-in-a-multi-site-index-1.html

View solution in original post

prakash007
Builder

It depends upon what's your approach in case you need to thaw the archived/frozen data..
-you might need all copies if you are following this process..
https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Restorearchiveddata#Clustered_data_thawin...

-in our case we just keep db_*(which has tsidx and raw data) in our NFS, and then we thaw/rebuild them on a stand-alone indexer(add it as a search peer to the search-head), so that we won't interrupt any cluster functionality ..read this splunk answer for more details..
https://answers.splunk.com/answers/635561/how-do-i-thaw-frozen-buckets-in-a-multi-site-index-1.html

Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...