sending data from splunk to another splunk once the data reaches a certain age

[dgavic]

Hello,

I would like to know how to set up Splunk to offload data from one Splunk indexer to another, once the data reaches a certain age. Currently our indexers are set to send data to frozen storage after one year. I would like our indexers to send data to another Splunk indexer once the data reaches 3 months old, where it will live until it hits the one year mark. Any help would be greatly appreciated.

Currently using Splunk 4.2.2, upgrading to 5 soon. Hopefully this is possible in either Splunk?

Thank you

[jbsplunk]

You can forward data from one instance of Splunk to another with outputs.conf, but you can't do it based on age. If you needed to do that, you'd have to rsync/scp the files from one instance to the other and then merge the data into the indexes where they should exist with some kind of script.

To migrate the individual buckets, you can use the procedure outlined here:

http://splunk-base.splunk.com/answers/23536/moving-indexes-to-a-new-splunk-server

[dgavic]

Thanks for the helpful tip jbslunk, i will definitely look into this.

Thank you