Hello,
I would like to know how to set up Splunk to offload data from one Splunk indexer to another, once the data reaches a certain age. Currently our indexers are set to send data to frozen storage after one year. I would like our indexers to send data to another Splunk indexer once the data reaches 3 months old, where it will live until it hits the one year mark. Any help would be greatly appreciated.
Currently using Splunk 4.2.2, upgrading to 5 soon. Hopefully this is possible in either Splunk?
Thank you
... View more