When backing up frozen data with Replication factor, is the rb_* needed?

[ndoerfler]

I have set a frozen path and need to keep data that has been frozen for a certain amount of time. Due to space restrictions, this needs to be moved to an NFS mount and backed up there, then cleared from the frozen path location.

Since it's a replication of 3, i found it silly that i was asked to back up 3 copies of the same data. I was under the assumption that i can backup just the db_ and not need to backup the rb_ files since everything needed for restore can be done by bringing back the db_ and going through the normal restoration process.

Is there a reason as to why i should keep both or 1 copy of the rb_ if i'm already backing up the db_ directories?

Any help is appreciated, thank you!

[prakash007 · Accepted solution]

It depends upon what's your approach in case you need to thaw the archived/frozen data..
-you might need all copies if you are following this process..
https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Restorearchiveddata#Clustered_data_thawin...

-in our case we just keep db_*(which has tsidx and raw data) in our NFS, and then we thaw/rebuild them on a stand-alone indexer(add it as a search peer to the search-head), so that we won't interrupt any cluster functionality ..read this splunk answer for more details..
https://answers.splunk.com/answers/635561/how-do-i-thaw-frozen-buckets-in-a-multi-site-index-1.html