How, if possible, would I copy or forward indexed data from one Splunk instance to another distributed Splunk instance on a separate network via a OneWay DATA diode?

[holtby88]

So my predicament is,

1. I have a FireEye CMS outputting HTTPS POST JSON data to a Spunk instance on one network (NW1).
2. I have our main Splunk environment on another network (NW2).
3. I have a requirement to use the indexed DATA from NW1 on NW2 for correlation purposes.
4. DATA can only be passed OneWay from NW1 to NW2, so no splunk TCP available.
5. Is the a way of Copying the Indexed DATA from NW1 and adding the indexed data to NW2 environment and be searchable.

Any advise will be well received

Cheers

[bmacias84]

Hello, this is technically possible with rsync, but you can only do this for warm and/or cold buckets. I dont recommend this but hey do what you got to do. Read this article on moving indexes https://wiki.splunk.com/Community:MoveIndexes.