topic Re: Copy logs from one index to another with use same host information in Splunk Search

Copy logs from one index to another with use same host information

MesutUgurlu — Fri, 17 Sep 2021 06:42:40 GMT

Hi,

I want to copy some logs in one index to another index with the same host information. I use collect command to do this process. But when i copy, i see that all host information is the same and write search head ip address. So I cant search by looking host information. How can I do it? Can you help me?

Thanks.

Best Regards

Re: Copy logs from one index to another with use same host information

gcusello — Fri, 17 Sep 2021 07:08:14 GMT

Hi @MesutUgurlu,

if the host value is fixed, you could add the "host" option in the search you're using to copy events from indexes, for more infos see at https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Collect

If instead it's variable, you could modify you search in something like this:

index=your_index | table _time host sourcetype _raw | collect index=your_new_index

in this way you'll be able to use the host field in searches but not using the host field, but the "orig_host" field.

Ciao.

Giuseppe

Re: Copy logs from one index to another with use same host information

MesutUgurlu — Fri, 17 Sep 2021 07:33:33 GMT

Hi @gcusello,

Thank you for replying my question and helping.

I have variable hosts so I ran the command which was your mentioned. But I do not see the host and sourcetype fields in the new index and also orig_host field.

Thank you

Best Regards

Re: Copy logs from one index to another with use same host information

gcusello — Fri, 17 Sep 2021 07:36:31 GMT

Hi @MesutUgurlu,

could you share one or two events in the new index generated by the search I hinted?

Ciao.

Giuseppe