Deployment Architecture
Highlighted

When backing up frozen data with Replication factor, is the rb_* needed?

Engager

I have set a frozen path and need to keep data that has been frozen for a certain amount of time. Due to space restrictions, this needs to be moved to an NFS mount and backed up there, then cleared from the frozen path location.

Since it's a replication of 3, i found it silly that i was asked to back up 3 copies of the same data. I was under the assumption that i can backup just the db_ and not need to backup the rb_ files since everything needed for restore can be done by bringing back the db_ and going through the normal restoration process.

Is there a reason as to why i should keep both or 1 copy of the rb_ if i'm already backing up the db_ directories?

Any help is appreciated, thank you!

0 Karma
Highlighted

Re: When backing up frozen data with Replication factor, is the rb_* needed?

Builder

It depends upon what's your approach in case you need to thaw the archived/frozen data..
-you might need all copies if you are following this process..
https://docs.splunk.com/Documentation/Splunk/7.2.0/Indexer/Restorearchiveddata#Clustereddatathawing

-in our case we just keep db_*(which has tsidx and raw data) in our NFS, and then we thaw/rebuild them on a stand-alone indexer(add it as a search peer to the search-head), so that we won't interrupt any cluster functionality ..read this splunk answer for more details..
https://answers.splunk.com/answers/635561/how-do-i-thaw-frozen-buckets-in-a-multi-site-index-1.html

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.