How can a specific time period of logs be recovered from one Splunk indexer, then restored into another indexer?

[cmcdole]

For example, if I needed the logs dated from January 1, 2016 - January 31, 2016 moved to a different indexer. How can this be achieved?

[jkat54]

Easiest method is to run your search that considers that time frame, table _raw, then export it and import it.

Of course the export has a default limit of 10k events in csv, etc...

Another method is a bit more barbaric and probably wont get exact dates, but you can copy index buckets from one server to the other, and then using the delete command, you can trim it to the exact data you want. Bonus to this is there is no license hit. Drawback is that you'll have to look through the index manifest files to find the names of the buckets you want to move. The manifests have date ranges and event counts of each bucket so it's fairly straightforward once you locate them:

C:\Program Files\Splunk\var\lib\splunk\defaultdb\db.bucketManifest <- for example

[cmcdole]

Thank you for the fast replies. I will take a look at this and let you know if that does it.

[jkat54]

Are the indexers in the same cluster, different clusters, one is standalone, new indexer is in a cluster, both are standalone?

Whats the setup? This is a very tricky operation IMHO.

[cmcdole]

Both the indexers are standalone.

[jkat54]

Ok thanks... it will take a moment+ for me to type the answer.