Splunk Enterprise

Is there a tool for Splunk, that is similar to Curator in Elasticsearch?

alekseisaiko
Path Finder

Hi guys!
I'm curious if there's a tool for Splunk, that is similar to Curator in Elasticsearch, for deleting indexes, backuping and etc...
Deleting indexed that are older than 1 month for exmaple...

Thanks,

Aleksei

0 Karma
1 Solution

nickhills
Ultra Champion

Deleting indexes is done with the same mechanism used to create them (indexes.conf)

Backing up indexed data is left to the user to implement - very much depends on requirements, but for a stand alone Splunk deployment copying cold/warm/hot buckets from the source to a different destination is all that is required.

Data lifecycle is also managed in indexes.conf, allowing you to set a 'frozen' time period. Once that time range is reached the data can either be deleted, or passed to an archive process or script to take some other action.

In short, No. There is no specific tool for managing data lifecycle. Splunk provides the tools (or at least the hooks) for this within the core product.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

Deleting indexes is done with the same mechanism used to create them (indexes.conf)

Backing up indexed data is left to the user to implement - very much depends on requirements, but for a stand alone Splunk deployment copying cold/warm/hot buckets from the source to a different destination is all that is required.

Data lifecycle is also managed in indexes.conf, allowing you to set a 'frozen' time period. Once that time range is reached the data can either be deleted, or passed to an archive process or script to take some other action.

In short, No. There is no specific tool for managing data lifecycle. Splunk provides the tools (or at least the hooks) for this within the core product.

If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

alekseisaiko
Path Finder

Thanks a lot!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!