I will to make a back up of all the logs of splunk, so we want to be sure that all the host save the logs for a specific time, the windows will be around 28 hrs, more in specific the hosts of Windos and Unix servers
Hi @BryanCaballero,
if you're speaking of replication of Splunk Data between Indexers, you have to implement an Indexer Cluster,. for more infos see at https://docs.splunk.com/Documentation/Splunk/9.0.4/Indexer/Basicclusterarchitecture
If you're speaking of something else, please detail your requirements.
About Data Retention, you can configure it on Indexers (or on Master Node if you have an Indexer Cluster) following the instructions in my previous answer at https://community.splunk.com/t5/Getting-Data-In/Index-Retention-Time/m-p/641540#M109402
Ciao.
Giuseppe
