Is it possible to have a Splunk sandbox in the cloud, and to occasionally refresh it with a few weeks of data from a terrestrial instance from a physical DC?
