Clone a subset of data

[Skins]

I'd like to send a sample of my prod data to a test env.

Is this possible ?

for example my prod data from one sourcetype contains 100 servers (1-100) which are coming in via HEC on a HWF to prod

I'd like to send hosts 1 - 4 eg : ^server\s[1-4] to the test env as well

gratzi

[jconger]

There are a couple of ways to do this. If your test environment and prod environment are just different indexes in the same Splunk environment, you can use a search for your hosts along with the collect command. This is a popular technique for summary indexing. If your test and prod environments are completely separate, you will want to look at indexing and forwarding -> http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Perform_selective_...