I am new to administrating Splunk Enterprise Server. I'm guessing the answer is obvious to some, but I'm getting confused trying to figure out a solution from the documentation. We are using Splunk Enterprise Server v 9.2.1 stand-alone on an isolated network. We primarily collect and report on multiple systems' audit logging.  The server is set up and I can see ingested logs arriving and create reports on the data. But I need one more thing. I must archive all the original data exactly as it is received on the TCP receiver and copy it to offline storage for safe keeping. I need to be able to re-ingest the raw data at some future date, but that seems pretty straightforward. How can I do this?  Is there some way I can grab the data being received on my TCP port listener in RAW form or some magic I need to do with some indexer or forwarder->Receiver string?   I'm sure I'm not the first person to need this... How do others accomplish this stuff? Thank You! ... View more