Getting Data In

Use VSS Shadow Copy to Back Up Warm Buckets


I have a cluster of Windows indexers. I need to backup my new warm buckets every day and cannot afford to wait until buckets roll to frozen to back them up. I was thinking of creating a script that would copy out my warm buckets right from my Splunk storage and send them to my cold storage system. However, I was warned that this could interfere with Splunk trying to read from those buckets while I am copying them. My second thought was to use VSS shadow copies. I can have a script that creates a VSS shadow copy of my storage drive on my indexers, and then copies the warm buckets from the shadow copy, instead of copying from the original data. But my understanding of VSS is that it also will prevent Splunk from reading any data while the shadow copy is being made.

I have seen documentation referencing the use of VSS to back up warm buckets from Splunk, but nothing that goes into detail on how it works or how it should be implemented.

Here are my questions:
Is Splunk VSS aware?
Will VSS interfere with Splunk reading data from the warm buckets?
Am I right in thinking that copying buckets right from Splunk storage, with robocopy for example, will interfere with Splunk being able to read data?
Is there any other recommended way to back up Splunk storage without waiting for the buckets to roll to frozen?

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...