swati_sharma: I changed the answer so it reflects the correct directive. Basically, you are forcing the data to pass thru by reducing the buckets. Assuming you have data still flowing through, setting the 'bucket size' in both hot and warm to 1 will cause the data to quickly flow to cold. All of this is documented as mentioned above. ... View more

If you want to upload multiple files in Splunk, you can zip file and browse it ... View more

Ok, I'm guessing that you are trying out the free version of Splunk, and didn't actually buy a license. 🙂 Splunk is a tool for searching, correlating, reporting and alerting on (mainly) log data. Think of it as a powerful analytical tool, which also has capabilities to store data in its own internal format for a specified amount of time. Actually, you can decide to have different retention periods for different types of data. It is not a backup tool, but it is commonly used for fulfilling internal/external requirements for centralized logging, i.e. to have important logs moved away from the systems where they were generated. So in a sense, the logs are 'backed up' to a secondary system, but usually logs would never be restored to the originating system in the event of a crash/attack/whatever. I would guess that you could find the basic introductory videos on splunk.com, and a lot of detailed administrative tips on youtube. /K ... View more

If you have logs on a CIFs storage, you can mount it on a instance that has splunk and create an input to monitor this folder (as a local folder) . ... View more