https://community.splunk.com/t5/Getting-Data-In/Importing-older-logs-from-s370-s/m-p/73449#M15052 <P>This should help get you on the right track. There are a couple of options noted there (oneshot, batch) and details.</P> <P><A href="http://splunk-base.splunk.com/answers/919/what-is-the-best-way-to-load-archived-logs">http://splunk-base.splunk.com/answers/919/what-is-the-best-way-to-load-archived-logs</A></P> <P>Example of the command here as well.</P> <P><A href="http://splunk-base.splunk.com/answers/5428/how-do-you-override-source-on-a-oneshot">http://splunk-base.splunk.com/answers/5428/how-do-you-override-source-on-a-oneshot</A></P> Tue, 12 Jun 2012 19:40:26 GMT sdaniels 2012-06-12T19:40:26Z https://community.splunk.com/t5/Getting-Data-In/Importing-older-logs-from-s370-s/m-p/73448#M15051 <P>Hi,</P> <P>We purchased some s370's a number of months ago and after about a month or two we pointed the logs to an M670. We have now purchased Splunk for Ironport and want to take the logs from the S370's that existed before we pointed logging to the M670. How do we do that?</P> Tue, 12 Jun 2012 19:20:51 GMT https://community.splunk.com/t5/Getting-Data-In/Importing-older-logs-from-s370-s/m-p/73448#M15051 brierw 2012-06-12T19:20:51Z https://community.splunk.com/t5/Getting-Data-In/Importing-older-logs-from-s370-s/m-p/73449#M15052 <P>This should help get you on the right track. There are a couple of options noted there (oneshot, batch) and details.</P> <P><A href="http://splunk-base.splunk.com/answers/919/what-is-the-best-way-to-load-archived-logs">http://splunk-base.splunk.com/answers/919/what-is-the-best-way-to-load-archived-logs</A></P> <P>Example of the command here as well.</P> <P><A href="http://splunk-base.splunk.com/answers/5428/how-do-you-override-source-on-a-oneshot">http://splunk-base.splunk.com/answers/5428/how-do-you-override-source-on-a-oneshot</A></P> Tue, 12 Jun 2012 19:40:26 GMT https://community.splunk.com/t5/Getting-Data-In/Importing-older-logs-from-s370-s/m-p/73449#M15052 sdaniels 2012-06-12T19:40:26Z