Deployment Architecture

Splunk replication of old data

rteja9
Path Finder

I have a 5 node Indexer cluster with version 7.3.1.1. I added configuration to replicate data on indexer cluster but only new data is getting replicated. Old data which is in cluster before I added replication configuration is not replicated.
Is this how it is supposed to be? If not, how can I replicate old data?

Thanks in advance!!

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @rteja9,
Splunk replicates only new data it isn't possible to replicate already indexed data, to replicate old data you have to reindex them.

If you don't want to reindex all the old data, the only solution is the one I used last year:

  • I renamed every index in index_new,
  • I created an eventtype for each index ( index=my_index OR index=my_index_new ),
  • I replaced in every search index=my_index with eventtype=my_eventtype,
  • I copied the old index in each indexer of my cluster (obviously restarting Splunk).

in this way you have a searchable copy of your data in every indexer, and the old data will slowly decrease until the old index will be empty after the retention period.

Ciao.
Giuseppe

View solution in original post

gcusello
Legend

Hi @rteja9,
Splunk replicates only new data it isn't possible to replicate already indexed data, to replicate old data you have to reindex them.

If you don't want to reindex all the old data, the only solution is the one I used last year:

  • I renamed every index in index_new,
  • I created an eventtype for each index ( index=my_index OR index=my_index_new ),
  • I replaced in every search index=my_index with eventtype=my_eventtype,
  • I copied the old index in each indexer of my cluster (obviously restarting Splunk).

in this way you have a searchable copy of your data in every indexer, and the old data will slowly decrease until the old index will be empty after the retention period.

Ciao.
Giuseppe

rteja9
Path Finder

Thanks for your response. That makes sense.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...