How to speedup Splunk Indexer Data Transfer in importutil?

[hirt_lab]

We are having an issue transferring Splunk indexer data from one Virtual Environment to another, both environments are running VMWare. Our current process is to export the Indexers as .ova's from the source VMs and import them into the destination VM environment. The amount of data is large, approximately 1.5 TB. We need to be able to offload the primary data as quickly as possible in order to ready the system for further collection activity. Our current process is time-consuming, taking up to 24 hours, and has timeout issues. We are hoping to get Splunk recommendations on how to best transfer large amounts of Splunk indexer data from one location to another.

[deepashri_123]

Hey@hirt_lab,

Splunk stores data in the form of buckets.You can directly move these buckets from one environment to another.
Refer these links:
http://wiki.splunk.com/Community:MoveIndexes
http://docs.splunk.com/Documentation/Splunk/7.0.3/Indexer/Moveanindex

Let me know if this helps!!

[hirt_lab]

Thanks, will check it out an report back.