https://community.splunk.com/t5/Getting-Data-In/How-to-re-ingest-data-between-two-independent-Indexers/m-p/228760#M98989 <P>We have a Splunk setup with HF, Indexers in Cluster with one search head (SH).</P> <P>**<STRONG><EM>We do not have control on Indexers and SH as it is managed by other vendor</EM></STRONG></P> <P>We forward data to Indexers (On which we do not have control) now we need to <STRONG>archive the logs</STRONG> in our environmnet and are planning to use Splunk Indexer for same. Our HF will send a copy of data to Log Archiver (Indexer) and one copy to Vendor Indexer.</P> <P>As per requirement vendor may need old data which is present in Log Archive (Indexer) on adhoc basic.</P> <P>My question is how do we re-ingest the data from Log Archive (Indexer) to vendor Indexer so that they can analyse the data received from log archive (indexer). </P> Mon, 15 Aug 2016 07:08:49 GMT vikrantc 2016-08-15T07:08:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-re-ingest-data-between-two-independent-Indexers/m-p/228760#M98989 <P>We have a Splunk setup with HF, Indexers in Cluster with one search head (SH).</P> <P>**<STRONG><EM>We do not have control on Indexers and SH as it is managed by other vendor</EM></STRONG></P> <P>We forward data to Indexers (On which we do not have control) now we need to <STRONG>archive the logs</STRONG> in our environmnet and are planning to use Splunk Indexer for same. Our HF will send a copy of data to Log Archiver (Indexer) and one copy to Vendor Indexer.</P> <P>As per requirement vendor may need old data which is present in Log Archive (Indexer) on adhoc basic.</P> <P>My question is how do we re-ingest the data from Log Archive (Indexer) to vendor Indexer so that they can analyse the data received from log archive (indexer). </P> Mon, 15 Aug 2016 07:08:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-re-ingest-data-between-two-independent-Indexers/m-p/228760#M98989 vikrantc 2016-08-15T07:08:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-re-ingest-data-between-two-independent-Indexers/m-p/228761#M98990 <P>The only thing you can do is to find the original data and export it to a flat file, and then re-index it.</P> Mon, 15 Aug 2016 13:49:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-re-ingest-data-between-two-independent-Indexers/m-p/228761#M98990 sundareshr 2016-08-15T13:49:00Z