Deployment Architecture

Splunk replication of old data

rteja9
Path Finder

I have a 5 node Indexer cluster with version 7.3.1.1. I added configuration to replicate data on indexer cluster but only new data is getting replicated. Old data which is in cluster before I added replication configuration is not replicated.
Is this how it is supposed to be? If not, how can I replicate old data?

Thanks in advance!!

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rteja9,
Splunk replicates only new data it isn't possible to replicate already indexed data, to replicate old data you have to reindex them.

If you don't want to reindex all the old data, the only solution is the one I used last year:

  • I renamed every index in index_new,
  • I created an eventtype for each index ( index=my_index OR index=my_index_new ),
  • I replaced in every search index=my_index with eventtype=my_eventtype,
  • I copied the old index in each indexer of my cluster (obviously restarting Splunk).

in this way you have a searchable copy of your data in every indexer, and the old data will slowly decrease until the old index will be empty after the retention period.

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @rteja9,
Splunk replicates only new data it isn't possible to replicate already indexed data, to replicate old data you have to reindex them.

If you don't want to reindex all the old data, the only solution is the one I used last year:

  • I renamed every index in index_new,
  • I created an eventtype for each index ( index=my_index OR index=my_index_new ),
  • I replaced in every search index=my_index with eventtype=my_eventtype,
  • I copied the old index in each indexer of my cluster (obviously restarting Splunk).

in this way you have a searchable copy of your data in every indexer, and the old data will slowly decrease until the old index will be empty after the retention period.

Ciao.
Giuseppe

rteja9
Path Finder

Thanks for your response. That makes sense.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...