We're retiring our internally hosted Splunk environment and moving the data into an EC2 instance on AWS. It seems like our best solution is to use SmartStore and I'm trying to determine the best way to migrate our data.
- We're moving multiple TB of logs
- Once that data is in S3, we won't be adding any new logs to Splunk.
- We would like the old data searchable.
- We will be reducing our Indexer count for 7 down to 2 as this environment will be minimally accessed.
I believe the best solution is to enable SmartStore on our servers and once the data is transferred to S3, create the new indexers and decommission our old environment. Am I missing something with this plan?
