https://community.splunk.com/t5/Getting-Data-In/How-to-copy-data-from-an-index-to-another-machine/m-p/691289#M114982 <P>Hi<BR />I have a use case that involves copying historical data from a 3-indexer cluster (6 months old) to another machine. I have considered two potential solutions:</P><OL><LI>Stop one of the indexers and copy the index from the source to the destination. The only drawback could be that the data might be incomplete, but this is not a concern as the data is for testing purposes. Given the volume of data, this process could take a significant amount of time.</LI><LI>Create a new index using the collect command with the required set of data, then copy the index to the other machine. I believe this would be the best way to implement this use case. However, the downside is that the data volume is quite large and might take a considerable amount of time to execute the SPL in the search head, potentially affecting the performance of the SH. I am unsure if the collect command can handle such a large search and create an index. Is there a limitation on the size of the data when using the collect command?</LI></OL><P><BR />Please advise on how to best handle this scenario.</P><P>Regards,<BR />Pravin</P> Fri, 21 Jun 2024 11:53:40 GMT _pravin 2024-06-21T11:53:40Z https://community.splunk.com/t5/Getting-Data-In/How-to-copy-data-from-an-index-to-another-machine/m-p/691289#M114982 <P>Hi<BR />I have a use case that involves copying historical data from a 3-indexer cluster (6 months old) to another machine. I have considered two potential solutions:</P><OL><LI>Stop one of the indexers and copy the index from the source to the destination. The only drawback could be that the data might be incomplete, but this is not a concern as the data is for testing purposes. Given the volume of data, this process could take a significant amount of time.</LI><LI>Create a new index using the collect command with the required set of data, then copy the index to the other machine. I believe this would be the best way to implement this use case. However, the downside is that the data volume is quite large and might take a considerable amount of time to execute the SPL in the search head, potentially affecting the performance of the SH. I am unsure if the collect command can handle such a large search and create an index. Is there a limitation on the size of the data when using the collect command?</LI></OL><P><BR />Please advise on how to best handle this scenario.</P><P>Regards,<BR />Pravin</P> Fri, 21 Jun 2024 11:53:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-copy-data-from-an-index-to-another-machine/m-p/691289#M114982 _pravin 2024-06-21T11:53:40Z