Hi, I want to figure out a way to backup the Splunk data when the index is transferring from a Warm bucket to a cold bucket. Preferably I would like a trigger to back up all the stuff in the warm bucket when it's about to be moved to a cold bucket. ... View more

Here's what my job is set up like: # Set count to 0 to return all events in last minute kwargs = { "exec_mode": "blocking", "earliest_time": "-1h", "latest_time": "now", "count": 0 } # Create jobs for both queries logging.info("Creating jobs...") atlas = service.jobs.create(atlas_query, **kwargs) # Set unlimited results to return result_kwargs = { "count": 0 } # Parse results atlas_reader = results.ResultsReader(atlas.results(**result_kwargs)) However, I'm having problems with the data from the atlas_reader object. It takes several minutes to loop through it and save certain fields to a CSV file, even though there's only a few thousand events. The job itself finishes in about 5 seconds. I have no idea what is wrong. ... View more