Splunk Dev

Copy (not move) events into another index?

aworkman
Engager

I understand there's no way to do field extraction based on event types, but is there a way to COPY (not move) events into another index?

Tags (1)

shaa
Engager

hello! i was copy some data to new index with collect command but cipied data invisible. what wrong?

many thanks

dstricharz
Engager

Check out the command COLLECT. It allows you to specify a destination index while copying the result in events of your search.

jtrucks
Splunk Employee
Splunk Employee

You could export the results of a search matching the desired events to copy, then export in raw format (best done via CLI). Then you can use splunk add oneshot to index the data into the other index. This avoids messes with filenames et al.

You can export the events and then import them using the same sourcetype with:

splunk add oneshot yourdatafilenamehere -sourcetype yourdesiredsourcetypehere -index yourotherindexhere

Another option is to use a summary index instead, would be as easy as:

your event search here | collect index=yoursummaryindexnamehere

Perhaps elaborate on why you want to copy them to the other index? Also, is this on an ongoing basis or just once to copy historical data?

--
Jesse Trucks
Minister of Magic

mataharry
Communicator

You can copy the buckets from an index to another
- beware to avoid bucket id duplicates.
It will not be selective, all events will be present. But you can hide afterward using the "delete" command.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...