Is it possible to ship all of the splunk data out of indexers to s3 buckets?

[sah_abhi21]

Hey Splunk Gurus,

One quick question, is there any way to ship out all the splunk data from its indexers to aws s3 buckets?

Environment is splunk cloud.

Appreciate your response. Thanks

Abhi

[sah_abhi21]

Thanks for your response. Let us suppose I want to export all the contents of a particular index to s3 buckets, can we do it?

[isoutamo]

Here is described how it can do https://docs.splunk.com/Documentation/SplunkCloud/9.1.2308/Admin/DataSelfStorage

But remember that this remove all data from that index, only hot buckets are available!

[isoutamo]

Hi

basically yes, or at least all warm and cold, but this means that you will frozen those and those are not searchable anymore. Just decrease your retention time for all indexes as small as needed and ensure that you have defined and configured your own S3 buckets for storing frozen data. Otherwise you will lost your events!!!

BUT I'm not sure if this is what you are looking for? Can you describe your real issue, not your solution for it?

r. Ismo