topic Re: sending data from splunk to another splunk once the data reaches a certain age in Splunk Search https://community.splunk.com/t5/Splunk-Search/sending-data-from-splunk-to-another-splunk-once-the-data-reaches/m-p/31293#M178099 <P>Thanks for the helpful tip jbslunk, i will definitely look into this.</P> <P>Thank you</P> Wed, 13 Feb 2013 22:09:31 GMT dgavic 2013-02-13T22:09:31Z sending data from splunk to another splunk once the data reaches a certain age https://community.splunk.com/t5/Splunk-Search/sending-data-from-splunk-to-another-splunk-once-the-data-reaches/m-p/31291#M178097 <P>Hello,</P> <P>I would like to know how to set up Splunk to offload data from one Splunk indexer to another, once the data reaches a certain age. Currently our indexers are set to send data to frozen storage after one year. I would like our indexers to send data to another Splunk indexer once the data reaches 3 months old, where it will live until it hits the one year mark. Any help would be greatly appreciated.</P> <P>Currently using Splunk 4.2.2, upgrading to 5 soon. Hopefully this is possible in either Splunk?</P> <P>Thank you</P> Wed, 13 Feb 2013 20:36:33 GMT https://community.splunk.com/t5/Splunk-Search/sending-data-from-splunk-to-another-splunk-once-the-data-reaches/m-p/31291#M178097 dgavic 2013-02-13T20:36:33Z Re: sending data from splunk to another splunk once the data reaches a certain age https://community.splunk.com/t5/Splunk-Search/sending-data-from-splunk-to-another-splunk-once-the-data-reaches/m-p/31292#M178098 <P>You can forward data from one instance of Splunk to another with outputs.conf, but you can't do it based on age. If you needed to do that, you'd have to rsync/scp the files from one instance to the other and then merge the data into the indexes where they should exist with some kind of script. </P> <P>To migrate the individual buckets, you can use the procedure outlined here:</P> <P><A href="http://splunk-base.splunk.com/answers/23536/moving-indexes-to-a-new-splunk-server">http://splunk-base.splunk.com/answers/23536/moving-indexes-to-a-new-splunk-server</A></P> Wed, 13 Feb 2013 20:56:30 GMT https://community.splunk.com/t5/Splunk-Search/sending-data-from-splunk-to-another-splunk-once-the-data-reaches/m-p/31292#M178098 jbsplunk 2013-02-13T20:56:30Z Re: sending data from splunk to another splunk once the data reaches a certain age https://community.splunk.com/t5/Splunk-Search/sending-data-from-splunk-to-another-splunk-once-the-data-reaches/m-p/31293#M178099 <P>Thanks for the helpful tip jbslunk, i will definitely look into this.</P> <P>Thank you</P> Wed, 13 Feb 2013 22:09:31 GMT https://community.splunk.com/t5/Splunk-Search/sending-data-from-splunk-to-another-splunk-once-the-data-reaches/m-p/31293#M178099 dgavic 2013-02-13T22:09:31Z