Getting Data In

How to copy indexed data from one index to another index in smartstore enabled cluster

bsrikanthreddy5
Path Finder

I have a requirement to move indexed data from index-A to another index-B in a smart-store enabled cluster. Both indexes (A & B ) has data in the AWS s3-bucket.  I would like to know if the below steps works?

Steps :

  1. Stop the incoming data to index-A
  2. Roll the hot bucket  on index-A
  3. Move  the data from s3 for index-A  to index-B
    1. Using the aws s3 sync  s3://bucket-name/index-A  s3://bucket-name/index-B  
  4. Run bootstrap command on CM.
Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One cannot move data from one index to another.  Once the data is in an index it stays there until it ages out or is removed to make room for newer data.

NEVER mess with Splunk's S3 buckets.  Do so at your own risk and be prepared for a Bad Day.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...