Hi, I was wondering, is it possible to backup the last 2 months of indexed information?
The data is stored in buckets per index.
And each bucket has his timerange in the folder name in epoch time.
see http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/HowSplunkstoresindexes
It should not be difficult to write a script that will backup selectively all the buckets that contains any events more recent than 2 months ago.
PS: the hot buckets cannot be reliably copied because they are intensively written. A technique is to force them to roll to warm just before the backup.
The data is stored in buckets per index.
And each bucket has his timerange in the folder name in epoch time.
see http://docs.splunk.com/Documentation/Splunk/5.0/Indexer/HowSplunkstoresindexes
It should not be difficult to write a script that will backup selectively all the buckets that contains any events more recent than 2 months ago.
PS: the hot buckets cannot be reliably copied because they are intensively written. A technique is to force them to roll to warm just before the backup.