Deployment Architecture

move single index to another indexer using replication?


I see the whole "how do I move an index from one indexer to another" question has been asked before. I see there's even a wiki entry about it. However, it looks like those are all relatively old questions/answers. I'm pretty sure those all pre-date Splunk 6.

I was curious if perhaps there's some newer method to copy an index that might involve index replication of some sort nowadays? The amount of data I have to move is fairly large and I have to move it across a WAN. It's actually an index that's auto-loadbalanced on two servers in one datacenter that I'd want to move to two other servers in another datacenter. I thought it would sure be handy if I could do something like turn on replication, let that data sync behind the scenes for a week say, then just turn the indexes off on the current servers and be done with it.

I don't suppose there is such a thing with Splunk 6? If not, then I assume the answer is still what's in the wiki.


0 Karma


Index replication in the Splunk 5+ cluster sense doesn't replicate old buckets, and often isn't a good idea over a WAN anyway.

I'd set up a rate-limited rsync to copy over cold and warm buckets, grabbing new warm buckets once they stopped being hot. Once that's moved everything except currently hot buckets you can stop indexing on the old machines, move over the remaining buckets, and start indexing on the new machines - assuming you want to switch rather than just replicate.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...