Why do companies use Conducive's Archiver for Splunk App?

Restore Splunk Frozen Data

"We started off using Splunk's built-in mechanism to freeze/archive our compliance data. What we didn't realize at the time was how difficult it would be to restore that data. 

Our auditors requested that we go through an exercise to prove we could restore data for a specific time period across specific hosts. That's when we discovered we had millions of frozen archive files in the S3 archive. Because the entire archive was multiple terabytes of data, we we knew we didn't have enough disk space to restore all of it, which would have been the easy solution. Our goal was to restore the subset of frozen files requested by the auditors, but we calculated it would take at least 6 person-days to identify the files we needed to restore.

​We started searching the web for a solution when we found Conducive and their Archiver for Splunk. Using Conducive's Archiver we were able to scan and catalog our existing archive, allowing us to restore the exact data requested by the auditors, all in less than 1 day.

We're now using the Archiver to both manage frozen data archiving, as well as using it to provide reports to the auditors and restore the data as requested. We can do all of this from a UI that lets us choose the date ranges, sourcetypes, indexes and hosts to restore. The entire process usually only takes a few minutes of time."

Archiving Made Simple - IRS Data Retention Requirements

"Due to our work with the IRS, we are required to store 7 years of transactional data for any system that even remotely touches the IRS transactions. With a 200GB license, this translates to about 255TB of uncompressed storage in 7 years. We wanted to store the data securely in the cloud, instead of on-premise. Secondarily, we were worried about restoring frozen data at this volume. We didn't think it would be easy to find the specific frozen folders that contain the hosts or sources requested by Auditors."

"We started with the idea of using Splunk's built-in solution, but wanted a more comprehensive enterprise solution that includes compression, encryption and native cloud storage integration. After talking with a few Splunkers, we were introduced to Conducive and their Archiver for Splunk. Conducive's solution enabled us to easily manage our Splunk frozen/archived data."

​After implementing the Archiver, we reduced our storage costs to about $4/TB/month, or a little over $1000 per month in 7 years - and this number is dropping because cloud storage costs are dropping. We're also able to easily provide reports to auditors and restore data with the click of the mouse."

Auditor Reporting

"Our internal policy requires that we store 6 years of data, and our Auditors have asked that we provide reports proving this data is available and submit to the occasional test to restore the data. We currently keep 18 months of storage accessible. We don't want to keep 6 years of accessible data on local disk, and we don't want to use Splunk's S2 implementation to move searchable data into the cloud. We'd prefer to compress and archive the data to keep the Auditors happy.

We found Conducive's Archiver for Splunk by searching the Spunk App Store (Splunk Base). Their solution gives us reporting and restoring, along with managed archiving in the cloud. Additionally we can compress and encrypt the data in transit and at rest.

Using Conducive's Archiver for Splunk, we are able to provide timely reports to our Auditors and restore data as requested.

We're now using the Archiver to both manage frozen data archiving, as well as using it to provide reports to the auditors and restore the data as requested. We can do all of this from a UI that lets us choose the date ranges, sourcetypes, indexes and hosts to restore. The entire process usually only takes a few minutes of time."