So to resolve this issue I had to do the following. Configure Splunk Retention for MaxWarmDB = 1 and frozenTimeInSec = 604800. This allows only one warm db to exist and 7 day retention in cold.
I have a script that will force a hot to warm roll and then rsync the warmdb back to central.
Thanks to Lowell, i modified his example to work for what we need.
rsync -va --rsh=ssh --exclude "/db/hot*[0-9]"
root@$REMOTE:$SPLUNK/var/lib/splunk/defaultdb/
/$SPLUNK/var/lib/splunk/$CUSTOMDB
... View more