Getting Data In

How can we manually archive data one time while meeting compliance requirements?

AshleighS
Engager

Hi, can any one please help me find documentation / instructions that explain very simply how I can archive our Splunk data based on a date range (IE from 1 May 2016 to 13 November 2017) just one time? I see how I can change the conf files in two different ways to automate archiving, but we do not want to set that up; it would not suit our compliance requirements. We just need to archive this chunk of data just this one time.

We have two splunk indexers in our indexer cluster.

Your help is greatly appreciated, thank you!

woodcock
Esteemed Legend

This is the "standard line":
http://docs.splunk.com/Documentation/Splunk/latest/Search/Exportsearchresults

But if you are hard-core and like to live dangerously or need more direct control, you can take the red pill:
https://answers.splunk.com/answers/181466/what-is-recommended-on-moving-select-data-in-the-d.html
It starts with /opt/splunk*/bin/splunk cmd exporttool help.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

This is a perfect use case for just using collect to a summary index. You are not really summarizing anything, but the strategy would work. Set the summary index to move to cold and freeze quickly (in a few days) and then copy the frozen buckets to your permanent storage/retention method. You will know the data is there, and you can validate that the amount of data is right, do quick reporting and analysis from your summary index beforehand to make sure that the data is safely present, and so on, before the buckets roll to frozen.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...