Deployment Architecture

Move data to another index based on _time

zafunt
Explorer

I would like to move data based on the event time to another index. I've tried something like the following...

index=main _time < whatever | collect index=old

But, this changes all the src values to be the splunk indexer.

I've also tried to move items to "frozen" based on time. However, that seems to move events based on the time that the data was indexed.

Is there another way to do this?

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

move the buckets instead, it's easier to identify all the buckets containing your data.
then copy/move then to the new index.

  • use the |dbinspect index=main | convert ctime(endEpoch) AS start| convert ctime(startEpoch) AS end | table path state start end
    to get the list of your buckets, with their timerange.

  • stop splunk

  • copy or move them to the new indexpath

  • if needed, use the delete command to hide the events that you do not want

View solution in original post

yannK
Splunk Employee
Splunk Employee

move the buckets instead, it's easier to identify all the buckets containing your data.
then copy/move then to the new index.

  • use the |dbinspect index=main | convert ctime(endEpoch) AS start| convert ctime(startEpoch) AS end | table path state start end
    to get the list of your buckets, with their timerange.

  • stop splunk

  • copy or move them to the new indexpath

  • if needed, use the delete command to hide the events that you do not want

zafunt
Explorer

Thanks. This should work for me. I'll update with any additional steps that may be helpful to others.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...