Splunk

#Prereq Install NooBaa plugin (AWS plugin with a minor modification that allows configured REST endpoint)

Plugin location https://github.com/noobaa/Connectors/tree/master/Splunk

http://104.154.37.127:8000/en-US/account/login?return_to=%2Fen-US%2F

#Data Input Configuration

Create NooBaa account with Access Key and Secret Key:

Login to Splunk -> Apps -> manage apps -> choose Splunk Add-on for NooBaa (click on setup) -> provide the access key and secret key

Login to splunk -> settings-> data inputs -> NooBaa S3 -> New -> fill the information and start searching.

#Save Frozen on NooBaa

Install s3fs (https://github.com/s3fs-fuse/s3fs-fuse)

create passwd with 123:abc (or the real access/secret key)

chmod 600 passwd

mkdir /noobaa-frozen

/usr/local/bin/s3fs frozen /noobaa-frozen -o passwd_file=passwd -ouse_path_request_style -ourl=http://146.148.44.71/ -osigv2 -o parallel_count=8

update frozen path in /opt/splunk/etc/system/local/indexes.conf

(coldToFrozenDir = /noobaa-frozen)