Splunk index move

sriva6 · ‎03-06-2013

Hi,

I have all my inputs pointing at index "main" on my existing splunk server. I have added a new indexer to my splunk instance and want to move all the indexes to the main index of the new indexer. Also, want to point all the data inputs to the main index on the new indexer.

Please can you advise what would be the best way to do this?

martin_mueller · ‎03-07-2013

Stop old splunk, copy over index, redirect forwarders, start new splunk?

sriva6 · ‎03-07-2013

We do not have forwarders.

Splunk index move

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Preparing your Splunk Environment for OpenSSL3

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation

Splunk index move

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Preparing your Splunk Environment for OpenSSL3

Announcing Modern Navigation: A New Era of Splunk User Experience