COMMUNITY OFFICE HOURS

Cut Costs, Not Capabilities: Ingest Only What You Need with S3 Promote

Why S3 Promote Matters ?

Many organizations store massive volumes of valuable data in Amazon S3 that it isn’t always indexed in Splunk due to cost or retention strategies. With S3 Promote, organizations can now ingest historical data from S3 into Splunk Cloud on-demand, enabling deeper analysis, investigations, and detections whenever the need arises.

What can I ask in this AMA?

• How do I configure AWS IAM roles and S3 bucket permissions to grant Splunk Cloud the necessary access to my data?
• What are the steps to configure a new Promote job, and how can I monitor its progress and health within Data Manager?
• Which data formats does S3 Promote support, and can I use it for custom data types beyond standard AWS source types?
• How does S3 Promote affect my Workload or Ingest-based licensing, and is there a specific SKU required for this feature?
• Does Splunk automatically manage the deletion of promoted data, or are there specific best practices for handling data retention?
• Can I use S3 Promote to re-ingest data that was originally routed to S3 via Splunk Edge or Ingest Processors?