Getting Data In

Merge indices to one index

chrisitanmoleck
Path Finder

Hello,

we have a lot of indices with low amount of data (some MBs).
So I want to merge some indicies to one.

e.g:
Foo -> FooBar
Bar -> FooBar

How is that feasible?

0 Karma

chrisitanmoleck
Path Finder

If you want to copy data with the collect-command you should also add informations to host, sourcetype and source.
Otherwise these fields get a splunk-internal name.

index="foo" | collect index="bar" host="bar1" source="bar2" sourcetype="bar3"
0 Karma

kdimaria
Communicator

You can go into settings -> Indexes and create a new index. (FooBar) Then, you can use the collect command to move all the data to the new index.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Collect

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Ummm.... why?

If it's just for search time convenience, consider adding the same tag to each index as per this one...

https://answers.splunk.com/answers/123629/add-an-alternative-name-as-an-extra-index-identifier.html

Then, for cleanup purposes, create your new index, tag THAT index with the same tag, and redirect all indexing on the low-volume indexers to the new index. The data on the old indexes will roll off over time, cleaning up your system without you having to muck about with actually moving the old data.

0 Karma

niketn
Legend

Seems like you need to use collect command.

Refer to the following documentation

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect#Moving_events_to_a_differ...

Refer to the video tutorial to understand the concept of summary indexing: https://www.splunk.com/view/SP-CAAACZW

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

chrisitanmoleck
Path Finder

If I do it with collect and deactivate the old index, I can't find the moved data.
host=foo
has no result.

Otherwise index=bar has the correct results

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...