Splunk Dev

Copy (not move) events into another index?

aworkman
Engager

I understand there's no way to do field extraction based on event types, but is there a way to COPY (not move) events into another index?

Tags (1)

shaa
Engager

hello! i was copy some data to new index with collect command but cipied data invisible. what wrong?

many thanks

dstricharz
Engager

Check out the command COLLECT. It allows you to specify a destination index while copying the result in events of your search.

jtrucks
Splunk Employee
Splunk Employee

You could export the results of a search matching the desired events to copy, then export in raw format (best done via CLI). Then you can use splunk add oneshot to index the data into the other index. This avoids messes with filenames et al.

You can export the events and then import them using the same sourcetype with:

splunk add oneshot yourdatafilenamehere -sourcetype yourdesiredsourcetypehere -index yourotherindexhere

Another option is to use a summary index instead, would be as easy as:

your event search here | collect index=yoursummaryindexnamehere

Perhaps elaborate on why you want to copy them to the other index? Also, is this on an ongoing basis or just once to copy historical data?

--
Jesse Trucks
Minister of Magic

mataharry
Communicator

You can copy the buckets from an index to another
- beware to avoid bucket id duplicates.
It will not be selective, all events will be present. But you can hide afterward using the "delete" command.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...