Migrate from one index to another index with data integrity control

[lyukai]

Hi All,

I recently have a new requirement to turn on data integrity control for a index ("X"). However, as the index already has data, I have to create a new index ("Y") and index incoming data into Y.

i read, https://answers.splunk.com/answers/32176/is-it-possible-to-migrate-indexed-buckets-to-a-different-in... but i'm not sure i can do this as the new index has data integrity control.

any advice on the best way i can migrate historical data from X to Y?

Thanks a million!

Best Regards,
Eric

[davpx]

Have you thought about simply renaming the index and turning on data integrity control? After that you should be able to regenerate the hashes.

If this isn't an option for you, you'll have to replay the historical data from your forwarders by clearing the fishbucket once pointed to the new index, if that data it still exists.

https://answers.splunk.com/answers/28134/rename-an-index-in-4-1-8.html
https://docs.splunk.com/Documentation/Splunk/7.0.1/Security/Dataintegritycontrol#Regenerate_hashes

[mayurr98]

have a look at this
https://answers.splunk.com/answers/400563/best-approach-to-move-data-to-a-different-index.html