https://community.splunk.com/t5/Getting-Data-In/Clone-a-subset-of-data/m-p/440192#M94640 <P>There are a couple of ways to do this. If your test environment and prod environment are just different indexes in the same Splunk environment, you can use a search for your hosts along with the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect">collect</A> command. This is a popular technique for summary indexing. If your test and prod environments are completely separate, you will want to look at indexing and forwarding -&gt; <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding</A> </P> Thu, 07 Jun 2018 15:16:07 GMT jconger 2018-06-07T15:16:07Z https://community.splunk.com/t5/Getting-Data-In/Clone-a-subset-of-data/m-p/440191#M94639 <P>I'd like to send a sample of my prod data to a test env.</P> <P>Is this possible ? </P> <P>for example my prod data from one sourcetype contains 100 servers (1-100) which are coming in via HEC on a HWF to prod</P> <P>I'd like to send hosts 1 - 4 eg : <CODE>^server\s[1-4]</CODE> to the test env as well</P> <P>gratzi</P> Thu, 07 Jun 2018 13:11:32 GMT https://community.splunk.com/t5/Getting-Data-In/Clone-a-subset-of-data/m-p/440191#M94639 Skins 2018-06-07T13:11:32Z https://community.splunk.com/t5/Getting-Data-In/Clone-a-subset-of-data/m-p/440192#M94640 <P>There are a couple of ways to do this. If your test environment and prod environment are just different indexes in the same Splunk environment, you can use a search for your hosts along with the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect">collect</A> command. This is a popular technique for summary indexing. If your test and prod environments are completely separate, you will want to look at indexing and forwarding -&gt; <A href="http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding">http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding</A> </P> Thu, 07 Jun 2018 15:16:07 GMT https://community.splunk.com/t5/Getting-Data-In/Clone-a-subset-of-data/m-p/440192#M94640 jconger 2018-06-07T15:16:07Z