Getting Data In

How to copy indexed data from one index to another index in smartstore enabled cluster

bsrikanthreddy5
Path Finder

I have a requirement to move indexed data from index-A to another index-B in a smart-store enabled cluster. Both indexes (A & B ) has data in the AWS s3-bucket.  I would like to know if the below steps works?

Steps :

  1. Stop the incoming data to index-A
  2. Roll the hot bucket  on index-A
  3. Move  the data from s3 for index-A  to index-B
    1. Using the aws s3 sync  s3://bucket-name/index-A  s3://bucket-name/index-B  
  4. Run bootstrap command on CM.
Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One cannot move data from one index to another.  Once the data is in an index it stays there until it ages out or is removed to make room for newer data.

NEVER mess with Splunk's S3 buckets.  Do so at your own risk and be prepared for a Bad Day.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...