Archive
Highlighted

Copy Indexed data from one index to another index

Communicator

Hello All,

We have two indexes, old one is ABC and new one is DEF, ABC has ~100GB data, we wanted to move the data to DEF.

Can we copy ABC buckets and pasted under DEF index??
If so, will it consume additional license for DEF as well??
Is it recommended to do such a copy if needed??

Help in this regard is highly appreciated.

Thanks in advance!

BK

0 Karma
Highlighted

Re: Copy Indexed data from one index to another index

Champion

Copying is okay. It does not consume license.
However, if there is hot buckets, Splunk will not start so please change hot buckets to warm buckets.

Hot bucket will be warm bucket on restart. Or You can also change it with a command.
https://www.batchworks.de/manually-roll-buckets-from-hot-to-warm/

View solution in original post

0 Karma