Getting Data In

Clone a subset of data

Path Finder

I'd like to send a sample of my prod data to a test env.

Is this possible ?

for example my prod data from one sourcetype contains 100 servers (1-100) which are coming in via HEC on a HWF to prod

I'd like to send hosts 1 - 4 eg : ^server\s[1-4] to the test env as well


Tags (1)
0 Karma

Splunk Employee
Splunk Employee

There are a couple of ways to do this. If your test environment and prod environment are just different indexes in the same Splunk environment, you can use a search for your hosts along with the collect command. This is a popular technique for summary indexing. If your test and prod environments are completely separate, you will want to look at indexing and forwarding ->

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...