...ToFrozenscript.py
This will archive data to a particular directory that we mention inindexes.conf.
However it faces problems in cases of clustered architecture due to same multiple buckets being c...
...it unclear on how this works. Does it archive warm/coldbucketstoo? Does it archivefrozen data at all?
I want Splunk to be searching warm/cold data from the disks, not from S3 but it is unclear if t...
How can I send splunk coldbucketsto S3?
We have our on-premises splunk and send Splunk data to S3 for longer storage.
I came across this Hadoop Data Roll that sends the splunk data to S3A f...
...et search visibility into logs older than a few months
B) no longer roll bucketsinto Frozen (which seems to be aka 'deleted') but into archived, to facility easily restoring them when A) isn't as d...
...opies be archived? I'm trying to find out if I can save in terms of raw archive storage costs by implementing HDR versus archiving frozenbucketsto a set of NFS mounts.
...torage) and maybe a reason for the buckets being deleted?
Personally I think that something on the SAN in the background is weird, but I'd like to check Splunk.
Thank you
...ot/warm, cold and archived buckets of all the indexes. We would like to partition the volume such that it stores around 671GB of Hot/warm data, around 2TB of cold data, and remaining archive. We came u...
...hen cold rolls tofrozen and archives the frozenbucketsin the specified directory, but I only want toarchive specific logs, at random.
for example if I do a search and find a log that I would like to...
...olling of coldbucketstofrozen? how to stop this roll? 2. After mounting the new remote drive for frozenbuckets Is there a way to verify that frozen directory is receiving from cold