Splunk Dev

Archiving index frozen data to S3 using script coldToFrozenPlusS3Uplaod

Splunk_rocks
Path Finder

Hello Splunkers,

just trying to send my frozen/cold/archive data to AW s3 bucket here is the script i found , i was not able to understand Archive_dir path,My splunk index location is - /splunk/index/splunk/indexname so in this case what is the path for ARCHIVE_DIR

### CHANGE THIS TO YOUR ACTUAL ARCHIVE DIRECTORY!!!
ARCHIVE_DIR = "/splunkdb/archived_indexes"
#ARCHIVE_DIR = os.path.join(os.getenv('SPLUNK_HOME'), 'frozenarchive')

script_path = '' #for the logging library
log_file_path = '' #Where you want the ascript to log to. For example /var/log/splunk_archive.log
gnu_home_dir = '' #where the gpg directory is. For example /home/s3/.gnupg/
reciepient_email = '' #the email the gpg uses to encrypt the files
Tags (1)
0 Karma

MuS
Legend

Hi,

Is this all of the script or is there more? If so can you please update and all of the script?

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...