topic Re: How can I move one index data from production to test environment for testing purpose? in Deployment Architecture

How can I move one index data from production to test environment for testing purpose?

riqbal47010 — Thu, 17 Oct 2019 08:32:30 GMT

I have single instance test environment. How can I move one index data from productio to test environment for testing purpose.

Re: How can I move one index data from production to test environment for testing purpose?

gcusello — Thu, 17 Oct 2019 08:57:34 GMT

Hi
if you do not want to mask your production data to be used for the test, you could connect your test server as a Search Head of your indexers and use the production data for your tests (I am an auditor and shudder all by myself thinking of my suggestion!).

Otherwise you could perform a search on your index taking all the data of the period you are interested in and export them as a row data in a text file that you can then import on your test server (maybe masking them); in this way however you have license consumption.
The ideal of security would be to perform the extraction-level masking!

Ciao.
Giuseppe

Re: How can I move one index data from production to test environment for testing purpose?

riqbal47010 — Thu, 17 Oct 2019 09:16:35 GMT

this below post answer seems answering my question.

https://answers.splunk.com/answers/771891/splunk-test-environment.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev

althrough yours as well.