topic Re: Is it possible to divide an index to two indexes? in Splunk Search

Is it possible to divide an index to two indexes?

appleman — Tue, 14 Jan 2014 10:04:45 GMT

Hello there,

I just wonder if I can divide an index into two indexes.
e.g, Divide the data in index=main to index=production and index=text

Thank you.

既にIndex化されたデータ（Index1）を、途中で二つのindex（Index1とIndex2）に分けることは可能でしょうか。

例：index=mainに入っているデータを、途中でindex=production と index=testに分ける

Re: Is it possible to divide an index to two indexes?

linu1988 — Tue, 14 Jan 2014 12:14:56 GMT

Hello,
You could create two separate indexes. Use COLLECT command to pass that info into your required indices. But it will not be possible to divide the index further once it is created and data is in them. Before passing the events to the new indexes please read the documentation.

_http://docs.splunk.com/Documentation/Splunk/6.0.1/searchreference/collect

Re: Is it possible to divide an index to two indexes?

jbsplunk — Tue, 14 Jan 2014 18:20:32 GMT

If you wanted to split the main index in half, here is what you'd do with an out of the box install:

Create two new indexes called 'text and 'production'.
Go into the /opt/splunk/var/lib/splunk/defaultdb/db and /opt/splunk/var/lib/splunk/defaultdb/colddb. This is where the actual data sits inside of buckets using the format described here.
Move the data, using whatever logic you'd like, to the same location in the destination index so that half resides in one index and half the other. Ensure not to introduce any bucket id conflicts, otherwise the destination indexes will be disabled, as per this splunk answer.
Restart the Indexer and you should now be able to search the data in the new indexes.

Re: Is it possible to divide an index to two indexes?

appleman — Wed, 15 Jan 2014 01:29:14 GMT

Thank you.
So, it's possible to divide the index which has already indexed once, right? I'm bit confused since linu1988 below says it's not possible.....

Re: Is it possible to divide an index to two indexes?

lukejadamec — Wed, 15 Jan 2014 01:44:14 GMT

This solution creates a duplicate of the index in each of the new indexes, it does not separate them. Data that has been indexed cannot be altered.

You will have problems going forward, because all new data will be placed into Main unless you redirect the data to the desired index.

Re: Is it possible to divide an index to two indexes?

appleman — Wed, 15 Jan 2014 07:12:54 GMT

I understand that it is not possible to re-index the data which has been already indexed. I guess I should delete the data and create new indexes to divide them.

Re: Is it possible to divide an index to two indexes?

jbsplunk — Wed, 15 Jan 2014 17:27:26 GMT

Well, my suggestion was to move, not copy, the data. If you move it, you're not making duplicates because each index would only have a single copy of it, with half the buckets in test and half in production. Of course, you would need to adjust your inputs and/or props/transforms to ensure the data inputs you'd like are routing to production.