Rolling cold data to tape

[preotesoiu]

Hello,
We are planning for a solution to archive cold data to tape and I was wondering which one of these solutions will be better (coldToFrozenDir or coldToFrozenScript).
Initial plan was to use coldToFrozenDir into a separate volume and then have Tivoli Storage Manager to move it to tape but reading through Splunk documentation it appears that coldToFrozenScript is preferred when rolling to tape.
Have you implemented such a solution and what would be the conditions that have to be met in order to have a successful implementation?

[inventsekar · Accepted solution]

coldToFrozenScript is the best option as per my view.
- (instead of using coldToFrozenDir and then Tivoli Storage Manager to write to tape, you could directly do this with coldToFrozenScript)
- the cost of Tivoli Storage Manager
- extra configuration and maintenance works, etc..

between, how much data, approx you have or daily license limit please.

[preotesoiu]

Thanks.
We are doing several TB daily ingestion.
By the way, do you know if the script will take care of replicated buckets or if that is something we need to consider?

[s2_splunk]

It will not. Data rolls individually per indexer, so if you are running index replication, you may want to remove all replicated buckets and only move primaries in your script.

[preotesoiu]

much appreciated! I have what I need for now to start testing...
G