topic Re: How can a specific time period of logs be recovered from one Splunk indexer, then restored into another indexer? in Getting Data In

How can a specific time period of logs be recovered from one Splunk indexer, then restored into another indexer?

cmcdole — Tue, 24 May 2016 12:55:07 GMT

For example, if I needed the logs dated from January 1, 2016 - January 31, 2016 moved to a different indexer. How can this be achieved?

Re: How can a specific time period of logs be recovered from one Splunk indexer, then restored into another indexer?

jkat54 — Tue, 24 May 2016 13:09:12 GMT

Are the indexers in the same cluster, different clusters, one is standalone, new indexer is in a cluster, both are standalone?

Whats the setup? This is a very tricky operation IMHO.

Re: How can a specific time period of logs be recovered from one Splunk indexer, then restored into another indexer?

cmcdole — Tue, 24 May 2016 13:14:01 GMT

Both the indexers are standalone.

Re: How can a specific time period of logs be recovered from one Splunk indexer, then restored into another indexer?

jkat54 — Tue, 24 May 2016 13:27:04 GMT

Ok thanks... it will take a moment+ for me to type the answer.

Re: How can a specific time period of logs be recovered from one Splunk indexer, then restored into another indexer?

jkat54 — Tue, 24 May 2016 13:32:27 GMT

Easiest method is to run your search that considers that time frame, table _raw, then export it and import it.

Of course the export has a default limit of 10k events in csv, etc...

Another method is a bit more barbaric and probably wont get exact dates, but you can copy index buckets from one server to the other, and then using the delete command, you can trim it to the exact data you want. Bonus to this is there is no license hit. Drawback is that you'll have to look through the index manifest files to find the names of the buckets you want to move. The manifests have date ranges and event counts of each bucket so it's fairly straightforward once you locate them:

C:\Program Files\Splunk\var\lib\splunk\defaultdb\db.bucketManifest <- for example

Re: How can a specific time period of logs be recovered from one Splunk indexer, then restored into another indexer?

cmcdole — Tue, 24 May 2016 13:37:12 GMT

Thank you for the fast replies. I will take a look at this and let you know if that does it.