We have a Splunk setup with HF, Indexers in Cluster with one search head (SH).
**We do not have control on Indexers and SH as it is managed by other vendor
We forward data to Indexers (On which we do not have control) now we need to archive the logs in our environmnet and are planning to use Splunk Indexer for same. Our HF will send a copy of data to Log Archiver (Indexer) and one copy to Vendor Indexer.
As per requirement vendor may need old data which is present in Log Archive (Indexer) on adhoc basic.
My question is how do we re-ingest the data from Log Archive (Indexer) to vendor Indexer so that they can analyse the data received from log archive (indexer).
