Archive
Highlighted

dump command - indexer cluster question

Communicator

We want to extract existing data (very little, less than a GB) from an index. Is there a best practice for running the dump command on an indexer cluster (3 nodes) for a specific index? Do I have to run this command individually on each indexer in the cluster to ensure all data in the cluster is extracted properly?

Tags (2)
0 Karma
Highlighted

Re: dump command - indexer cluster question

Super Champion

For low amount of data, it is much better to do an outputlookup of the data via GUI. So you don't have to worry about nodes etc

index=whateverindex sourcetype=somesourcetype | table index,host,sourcetype,_raw| outputlookup dataoutput.csv

Then copy this dataoutput.csv for your purposes (or select relevant field)

Highlighted

Re: dump command - indexer cluster question

Communicator

Thanks for the response @koshyk. The data size was a bit larger than I expected, so I rean the dump command on all indexers and imported them. Seemed to do the trick. Thanks again for the suggestion though!

Commands:
Dump:
/opt/splunk/bin/splunk search 'index=myoldidx latest="05/23/2019:11:33:55" | dump basefilename=myoldidx.log'; find /opt/splunk/var/run/splunk/dispatch//dump/ -type f -name 'myoldidx .log' | xargs -I {} mv {} /opt/splunk/etc/slave-apps/newapphere

Import:
find /opt/splunk/etc/slave-apps/newapphere/ -type f -name 'myoldidx.log*' | xargs -I {} /opt/splunk/bin/splunk add oneshot {} -sourcetype mynewsthere -index mynew_idx -rename-source /dir/foo/bar

View solution in original post