Is there a tool for Splunk, that is similar to Curator in Elasticsearch?

[alekseisaiko]

Hi guys!
I'm curious if there's a tool for Splunk, that is similar to Curator in Elasticsearch, for deleting indexes, backuping and etc...
Deleting indexed that are older than 1 month for exmaple...

Thanks,

Aleksei

[nickhills · Accepted solution]

Deleting indexes is done with the same mechanism used to create them (indexes.conf)

Backing up indexed data is left to the user to implement - very much depends on requirements, but for a stand alone Splunk deployment copying cold/warm/hot buckets from the source to a different destination is all that is required.

Data lifecycle is also managed in indexes.conf, allowing you to set a 'frozen' time period. Once that time range is reached the data can either be deleted, or passed to an archive process or script to take some other action.

In short, No. There is no specific tool for managing data lifecycle. Splunk provides the tools (or at least the hooks) for this within the core product.

[alekseisaiko]

Thanks a lot!