- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Federated Search Archived Data in s3?
pdominicb
New Member
12-28-2023
09:22 AM
Is federated search able to search frozen buckets in s3? Or only raw logs?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
12-28-2023
11:36 AM
Splunk is unable to search frozen buckets in any location. Frozen buckets must be thawed before they can be searched.
As I understand it, FS-S3 is intended to allow searching of raw data resident in an S3 bucket. It's not for searching "cooked" data.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
