Archiving data with multiple indexers in a clustered environment

[GaetanVP]

Hello Splunkers,

In a Splunk clustered environment, the "coldToFrozenDir" will be the same for each indexer since it's deployed by the master node for each indexers.

So how Splunk will handle the fact that each indexers has replicated  data ? Will the data be duplicated on my archive storage ?

Regards,
GaetanVP  

[PickleRick]

https://docs.splunk.com/Documentation/Splunk/9.0.2/Indexer/Bucketsandclusters#How_the_cluster_handle...

[isoutamo]

Hi

If those directories are different then you have RF count of versions. One primary and other secondaries.

If you want only one then you must use coldToFrozenScript (check the correct name). In this script you can define what you are archiving and how many copies. Probably good way is archive primary and also one secondary copy?

r. Ismo