Getting Data In

Use VSS Shadow Copy to Back Up Warm Buckets

sjcoluccio67
Explorer

I have a cluster of Windows indexers. I need to backup my new warm buckets every day and cannot afford to wait until buckets roll to frozen to back them up. I was thinking of creating a script that would copy out my warm buckets right from my Splunk storage and send them to my cold storage system. However, I was warned that this could interfere with Splunk trying to read from those buckets while I am copying them. My second thought was to use VSS shadow copies. I can have a script that creates a VSS shadow copy of my storage drive on my indexers, and then copies the warm buckets from the shadow copy, instead of copying from the original data. But my understanding of VSS is that it also will prevent Splunk from reading any data while the shadow copy is being made.

I have seen documentation referencing the use of VSS to back up warm buckets from Splunk, but nothing that goes into detail on how it works or how it should be implemented.

Here are my questions:
Is Splunk VSS aware?
Will VSS interfere with Splunk reading data from the warm buckets?
Am I right in thinking that copying buckets right from Splunk storage, with robocopy for example, will interfere with Splunk being able to read data?
Is there any other recommended way to back up Splunk storage without waiting for the buckets to roll to frozen?

0 Karma
Get Updates on the Splunk Community!

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...

New This Month in Splunk Observability Cloud - Synthetic Monitoring updates, UI ...

This month, we’re delivering several platform, infrastructure, application and digital experience monitoring ...