topic Re: Issues moving data from one index to another in Knowledge Management

Issues moving data from one index to another

byu168 — Wed, 22 Mar 2017 16:51:36 GMT

I was attempting to move events from one index to another using this command

index=main host=gpm source=/var/log/gpm/gpm.log | collect index=gpm sourcetype=gpm

I checked the initial search to verify all the events I want are there, however, after running the entire command and checking index=gpm there are no events stored in it. gpm is a newly created index that has no events in it at all. Is there any reason that this issue is occurring?

Re: Issues moving data from one index to another

ddrillic — Wed, 22 Mar 2017 17:50:01 GMT

Another approach - Move data to another index based on _time

Re: Issues moving data from one index to another

byu168 — Wed, 22 Mar 2017 17:53:53 GMT

I wasn't able to figure out the cause of the issue, however, since the size of data I was moving was relatively small I found it easier to simply reindex the data

Re: Issues moving data from one index to another

woodcock — Wed, 22 Mar 2017 18:53:18 GMT

If you are moving 100% of the contents of the index, you can easily just rename it from the OS. You need to stop splunk, find the indexes.conf file that contains the current index definition, change the name of the index there, go find the directory on disk and change the name there, too, then restart splunk.

Re: Issues moving data from one index to another

byu168 — Wed, 22 Mar 2017 19:36:32 GMT

Thanks for the information! I was selectively moving data but this information could be useful in the future.