topic Re: Exporting data and importing into another Splunk instance in Other Usage

Exporting data and importing into another Splunk instance

CSReviews — Wed, 03 Apr 2024 00:44:40 GMT

I am planning on teaching others how to use Splunk to search through data, similar to the Splunk boss of the soc challenges-

https://github.com/splunk/botsv3

Similarly, I would like to export the data I generated in my Splunk instance to then have students import into there's to follow along. The only way I can figure out how to do this is from running a search and using the export feature. Is there a recommendation for this?

Re: Exporting data and importing into another Splunk instance

splunkreal — Thu, 16 May 2024 19:10:58 GMT

Hello @CSReviews you can export as csv file it's then easy to import.

https://hurricanelabs.com/splunk-tutorials/ingesting-a-csv-file-into-splunk/

"Upload with Splunk Web"

Re: Exporting data and importing into another Splunk instance

isoutamo — Thu, 16 May 2024 19:59:05 GMT

there some apps, which you could use to generate continuously sample data. Probably mostly used is eventgen https://splunkbase.splunk.com/app/1924.

One option is just e.g. tar that index and untar it on target systems. Of course you need to do also app for defining it on those target systems. This needs that those nodes are enough equal like same Linux etc. If I recall right something like this was done for those older bots datasets?

r. Ismo