Attempting to bring this current. For Splunk cloud: customers: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Admin/DataSelfStorage For Splunk enterprise with SmartStore(s3): https://docs.splunk.com/Documentation/Splunk/8.1.3/Indexer/SmartStorearchitecture https://aws.amazon.com/blogs/aws/archive-s3-to-glacier/ For Splunk enterprise without smartstore: No similar feature found. Build your own as previously mentioned. see also (https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-put-cold-and-frozen-data-on-s3-in-AWS/)
... View more
INT96 type is deprecated by parquet.
Official link here : https://issues.apache.org/jira/browse/PARQUET-323
Hunk currently does not support int96 type.
You can follow recommendation in the link (https://issues.apache.org/jira/browse/PARQUET-323) to replace int96 with some other type.
... View more
If you are getting this message, event after having correct permissions and enough space, then issue could be happening because of timeout while copying package to the data nodes. The default timeout for the package copy is 20sec.
Setting for this in Hunk Provider is mentioned below.
vix.splunk.setup.package.setup.timelimit = time limit (in milliseconds)
Try after increasing timeout to 2 minutes.
... View more