Hi, I am trying to better understand how to correctly implement incremental backups in Splunk, and I would appreciate clarification on a few points regarding bucket structure and disaster recovery. We have a single AIO instance. 1. Bucket Structure and Incremental Backups When data rolls to the frozen state, I observe that the bucket contains only a single file (journal.zst). However, in warm buckets, the rawdata directory contains multiple files such as: journal.zst, slicemin.dat, slicesv2.dat Q1: What is the role of these files within the bucket structure? Specifically, how do slicemin.dat and slicesv2.dat relate to journal.zst? Q2: If I want to implement incremental backups, is it sufficient to back up only journal.zst, or is it necessary to archive the entire bucket (including all associated metadata and index files)? 2. Disaster Recovery and License Considerations In a disaster recovery scenario (e.g., disk failure), assume the following steps: - A new VM is provisioned - Splunk is installed and configured (including restoring configuration and license data) - Splunk recreates the necessary directory structure At this point, I have archived copies of warm and cold buckets (Based on the answer to Q1 and Q2 its a full bucket/directory or just the journal.zst). Q3: Where should archived warm and cold buckets be placed within the indexer’s directory structure to ensure proper recognition? Q4: After restoring these buckets, does Splunk need to re-index the data, or will the data immediately be searchable since it was already indexed prior to backup? Thank you in advance for your guidance.
... View more