I have a cluster of Windows indexers. I need to backup my new warm buckets every day and cannot afford to wait until buckets roll to frozen to back them up. I was thinking of creating a script that would copy out my warm buckets right from my Splunk storage and send them to my cold storage system. However, I was warned that this could interfere with Splunk trying to read from those buckets while I am copying them. My second thought was to use VSS shadow copies. I can have a script that creates a VSS shadow copy of my storage drive on my indexers, and then copies the warm buckets from the shadow copy, instead of copying from the original data. But my understanding of VSS is that it also will prevent Splunk from reading any data while the shadow copy is being made.
I have seen documentation referencing the use of VSS to back up warm buckets from Splunk, but nothing that goes into detail on how it works or how it should be implemented.
Here are my questions:
Is Splunk VSS aware?
Will VSS interfere with Splunk reading data from the warm buckets?
Am I right in thinking that copying buckets right from Splunk storage, with robocopy for example, will interfere with Splunk being able to read data?
Is there any other recommended way to back up Splunk storage without waiting for the buckets to roll to frozen?
