Restore smartstore from S3 versioning

[Youn]

If anyone knows, could you please let me know the following?
Our Splunk Enterprise system is based on AWS EC2.We use AWS S3 for Splunk SmartStore.We take backup of EBS and S3(smartstore) everyday.But the cost of S3 backup is very high.So we are planning to stop backup of  S3.Because we have Smart S3 versioning turned on. If we had to restore the EC2 , could we restore from S3 versioning?
Since the timing of EBS backup and S3 versioning are different, I think there may be a problem if I restore EBS and restore S3 from a previous version at a different slice. Since I want to prioritize cost reduction, it is not a problem if some data on the EBS side is missing as long as it can be read without any problems.
Please let me know if you have any ideas on how to reduce backup costs in a similar environment.

[Youn]

Hi @livehybrid 

Thank you for your reply. We don't have an indexer cluster. I understand that if I create a cluster and have a replica bucket, it will be possible to protect buckets. Thank you for introducing the reference site. I will check it out.

I am planning to restore a configuration file from EBS.Will Splunk still function if some of the logs in the EBS hot bucket and some of the logs in the S3 warm bucket are duplicated?

[livehybrid]

Hi @Youn 

When a bucket in a SmartStore index rolls to warm, the bucket is copied to S3 remote storage, therefore its only the hot buckets which will be on EBS and *not* on  S3. 

What does your architecture look like? Do you have an indexer cluster? If so you should have a replica bucket on another indexer, so in the event of a failure to an EC2 instance your replica will still exist and when rolled to warm can be uploaded to S3.

The following might be useful for you in terms of backup strategy https://cloudian.com/guides/splunk-big-data/splunk-backup-what-are-your-options/#smartstore - Ultimately I'm not sure if the EBS backup gives you something you need, do you have a process around this to enact when you need to rebuild a host? 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing