Deployment Architecture

Storing logs in a datacenter

superzeeman
Engager

I need to store logs for a year and I cant reasonably store it all on the computer I installed Splunk on. Is there a way to keep the raw logs stored on a data center? I want to buy a 4 gig storage device to store everything on. It is not an actual computer, just data storage.

Tags (3)
0 Karma

yannK
Splunk Employee
Splunk Employee

The data has to be indexed on the indexers at one point. And written to disk in buckets in indexes folders.
Each bucket represent events for a given timerange.
the lifetime of a bucket is HOT -> WARM -> COLD (not always)
then deleted or archived -> FROZEN
then restored -> THAWED
see http://docs.splunk.com/Documentation/Splunk/5.0.4/Indexer/HowSplunkstoresindexes

The HOT/WARM/COLD/THAWED buckets present on the indexers are searchable.
When a bucket became frozen it's deleted by default, but instead deleting them, you could setup a policy to archive them on another storage (mount, backup, aws, etc...) .
and when needed copy them back as THAWED on the indexers to make them searchable again on them.

see the parameters : coldToFrozenDir
and the retention policies
http://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

superzeeman
Engager

Thanks! I will read the info and see if I can make sense of it all.

0 Karma

lukejadamec
Super Champion

Do you want to be able to search the data that is stored in the datacenter? Or, are you looking to save the data in case you need to search it later?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...