Splunk Dev

Copy Indexed data from one index to another index

bharathkumarnec
Contributor

Hello All,

We have two indexes, old one is ABC and new one is DEF, ABC has ~100GB data, we wanted to move the data to DEF.

Can we copy ABC buckets and pasted under DEF index??
If so, will it consume additional license for DEF as well??
Is it recommended to do such a copy if needed??

Help in this regard is highly appreciated.

Thanks in advance!

BK

0 Karma
1 Solution

HiroshiSatoh
Champion

Copying is okay. It does not consume license.
However, if there is hot buckets, Splunk will not start so please change hot buckets to warm buckets.

Hot bucket will be warm bucket on restart. Or You can also change it with a command.
https://www.batchworks.de/manually-roll-buckets-from-hot-to-warm/

View solution in original post

0 Karma

HiroshiSatoh
Champion

Copying is okay. It does not consume license.
However, if there is hot buckets, Splunk will not start so please change hot buckets to warm buckets.

Hot bucket will be warm bucket on restart. Or You can also change it with a command.
https://www.batchworks.de/manually-roll-buckets-from-hot-to-warm/

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...