Archive Splunk buckets to AWS S3?

[sarnagar]

How can I send splunk cold buckets to S3?
We have our on-premises splunk and send Splunk data to S3 for longer storage.

I came across this Hadoop Data Roll that sends the splunk data to S3A filesystem. This looks something to deal with Hadoop+S3 , which Im not quite aware of. I'm very new to AWS. I thought Splunk can send data directly to S3 for archival. Isnt that possible?

The document says to provide some provider parameters. Can someone please elaborate on this? Does this mean I need to have Hadoop installed on S3?

link text

[ByteFlinger]

It seems difficult to find documentation on the coldToFrozen script API.

Any chance you can give an example on how one would setup an indexes.conf with a couple of indexes using the cold2frozen.py?