Hi! Please, help us with right organization of storages. Separate storage is necessary for current information and historical information. We want to store historical information (events and flows) on slow media and be able to unpack it for analysis only if necessary. The total archive depth is needed for 1 year (3 months of current logs and 9 months of historical ones). Which solutions or backup (and restore backup) procedures can be? As i understand needed set 3 month retention for data (events and flows) and 9 month backup retention. Backups will store in /store/backup from which we can move backup files to our internal storage? But every backup will contain early backuped data?
#QRadar#Support#SupportMigration