Hi, Splunk logs are collected in buckets (hot, warm, cold, frozen, thawed) and depending on the environment settings they follow the process of roll out from hot -> warm -> cold. It has an entire process for this and you could better have a look here for more details: http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/HowSplunkstoresindexes One note here is that hot buckets (most recent data) is in active writing stage, so you can't backup/move that data until in reaches warm stage. If you want to sent those logs to cloud, for archiving purposes, you could copy the relevant archives to the cloud and you will be able later to bring them back to thawed and search them. To find out the buckets you need to backup you could use in search | dbinspect to identify them. Location is usually in $SPLUNK_HOME/var/lib/splunk/your_index/db/ but cold data can be moved to an external storage (other Volume). | dbinspect index=your_index | table bucketId, startEpoch, endEpoch, id, index, modTime, path, sizeOnDiskMB, splunk_server, state Regards ... View more