Getting Data In

Move events from an index to another one

rbw78
Communicator

Hello

I search could i move sepcific data from an index called index1 to another one called index2.

Let's say i have all this kind of events in my index 1 :
Events kind 1
Events kind 2
Events kind 3
Events kind 4

I want to move all the events 3 & 4 to index index2 and delete them from index1.

So the final result would be :
Index1 :
Events kind 1
Events kind 2

Index2 :
Events kind 3
Events kind 4

Is there a way to do that ?

Thanks.

Tags (3)
0 Karma

jonuwz
Influencer

I'm guessing this is a 1 off and you don't have the raw data inputs anymore ?

If thats true,

If index2 does not exist already, by far the easiest solution would be to make a copy of index1 called index2, delete everything but kind3 and kind4 from index2, then delete kind3 and kind4 from index1.

If index2 exists already and you're wearing your rubber safety pants, you could try this :

  1. make a copy of index1 called index3
  2. delete everything but kind3 and kind4 from index3
  3. merge index3's buckets into index2
  4. delete index3
  5. deleting kind3 and kind4 from index1

It goes without saying, backup your indexes 1st, and please report back if it works : )

You are going to waste a lot of space though, deleting data from an index doesn't free up space, it just marks it as deleted.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...