Aside from using 'export' result, is there a way on doing a 'one shot archiving' of the indexer cluster using archiving policy of Splunk? If there is one, what are the recommended steps on doing so. Thank you.
Regards,
Raj
