Getting Data In

How to copy indexed data from one index to another index in smartstore enabled cluster

bsrikanthreddy5
Path Finder

I have a requirement to move indexed data from index-A to another index-B in a smart-store enabled cluster. Both indexes (A & B ) has data in the AWS s3-bucket.  I would like to know if the below steps works?

Steps :

  1. Stop the incoming data to index-A
  2. Roll the hot bucket  on index-A
  3. Move  the data from s3 for index-A  to index-B
    1. Using the aws s3 sync  s3://bucket-name/index-A  s3://bucket-name/index-B  
  4. Run bootstrap command on CM.
Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One cannot move data from one index to another.  Once the data is in an index it stays there until it ages out or is removed to make room for newer data.

NEVER mess with Splunk's S3 buckets.  Do so at your own risk and be prepared for a Bad Day.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...