Deployment Architecture

Backing up is not automated?

michael_lee
Path Finder

Hi,

What is the standard practice to clear up space ? for example I have configured splunk to receive syslogs everyday. However now my disk space keeps filling up. I want to backup my index (for the syslogs) , truncate data in the index and start afresh. Isn't there a seamless or "automated" way to do index backing up?
thanks

Tags (3)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I'd suggest you read through this and familiarize yourself with how Splunk manages index data for you. Data is stored in buckets, which go through multiple stages, namely from HOT (actively written to) to WARM (read-only) to COLD (read-only) to FROZEN (not searchable).
You have full control over how long you keep data in each stage, either by specifying a time period or by limiting how much disk space each stage can consume.

This is fully automatic, but it DOES NOT replace backing up your data, if you are concerned about data loss. Take a gander at this for best practices around backing up your index data and/or consider using index replication to guard against indexer/data loss.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...