Copying one Index from a Cluster to a single install for test

[robertlynch2020]

HI

I have a cluster(3 indexers) with data and I want to copy one index "logs_Test" data to a single install for testing.

Can I copy it from the back end on all 3 and bring them together, I feel this won't work.

Can I export it from the Search head to a new index and then move that?

Any ideas would be great 

Thanks in advance

Robbie

[richgalloway]

The answer depends on what you intend to test, but you should be able to treat the data as frozen and copy the buckets from all 3 indexers into the thawed directory to a standalone indexer.  See https://docs.splunk.com/Documentation/Splunk/9.2.1/Indexer/Restorearchiveddata for how to thaw data.

[robertlynch2020]

Hi

Thanks for this.

I have the following on 3 indexers.

In the DB folder, the hot buckets have the same name on some indexes, so I don't think I can copy these. Perhaps I should not copy them over and go for the other ones.

I also see the data in the datamodel_summary section, but I have no data models on this data.

Perhaps I don't need to copy these as well?

Cheers

Rob