Hi Splunkers,
I'm now considering of backing up Splunk indexes to prepare for recovery. I know that any buckets without hot are able to back up by copy. Hot buckets are not able to copy because it's always under Splunk process (writing, and so on).
So we have an option of rolling from hot to warm manually, but it may be not recommended in terms of search performance that we always do that.
And there is an other way to back up hot buckets. That is a snapshot. According to Splunk documentation, it seems that snapshots enable us to get backups of hot buckets. However, we don't always have such tools or environments. Splunk clustering either.
Now I want to ask everyone that how to back up hot buckets ? Giving up to backup hot buckets ? Thank you for your help.