Archive

Tar'ing index so that it is distributable to other Splunk instance

Splunk Employee
Splunk Employee

[1] I would like to know if I can tar an index from a Splunk instance and then untar it into other Splunk instance?

[2] Would untar'ing the index overwrites the already existing events of that other Splunk instance?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee
  1. Yes you can.
  2. Copy it to a new index instead and it won't. If you are trying to merge index contents, then you should only copy individual buckets (i.e. exclude index-level metadata), and make sure the bucket ID numbers are changed so there are no conflicts. Or delete the old index first if you are not trying to merge.

View solution in original post

Splunk Employee
Splunk Employee
  1. Yes you can.
  2. Copy it to a new index instead and it won't. If you are trying to merge index contents, then you should only copy individual buckets (i.e. exclude index-level metadata), and make sure the bucket ID numbers are changed so there are no conflicts. Or delete the old index first if you are not trying to merge.

View solution in original post

Splunk Employee
Splunk Employee

Thanks! I'll try this out.

0 Karma