Due to our strict security policies I need to show a security representative that Splunk can not only index windows event logs but also archive them to a directory.
I know I can set this up for automation via the coldToFrozenScript field in indexes.conf, but I was wondering if there was a way to add this functionality to the user interface so that I could simply click on a link and go to a backup directory and view the newly archived file.
Thanks for your time.
Steve
