Start Splunk Version 7.2, Splunk has provided a Smart Store capability where they provide a way to use remote object store like Amazon S3. These features allow data to reside either locally on indexers or on the remote storage tier. Data movement between the indexer and the remote storage tier.
With SmartStore, you can reduce the indexer storage footprint to a minimum and choose I/O optimized compute resources. Most data resides on remote storage, while the indexer maintains a local cache that contains a minimal amount of data: hot buckets, copies of warm buckets participating in active or recent searches, and bucket metadata.
If I understand you correctly, this method will rely on coldToFrozenScript to copy fronzendb into S3.
Do you have any recommended script to be used for copying frozendb into S3 Glacier?
