Getting Data In

Move events from an index to another one



I search could i move sepcific data from an index called index1 to another one called index2.

Let's say i have all this kind of events in my index 1 :
Events kind 1
Events kind 2
Events kind 3
Events kind 4

I want to move all the events 3 & 4 to index index2 and delete them from index1.

So the final result would be :
Index1 :
Events kind 1
Events kind 2

Index2 :
Events kind 3
Events kind 4

Is there a way to do that ?


Tags (3)
0 Karma


I'm guessing this is a 1 off and you don't have the raw data inputs anymore ?

If thats true,

If index2 does not exist already, by far the easiest solution would be to make a copy of index1 called index2, delete everything but kind3 and kind4 from index2, then delete kind3 and kind4 from index1.

If index2 exists already and you're wearing your rubber safety pants, you could try this :

  1. make a copy of index1 called index3
  2. delete everything but kind3 and kind4 from index3
  3. merge index3's buckets into index2
  4. delete index3
  5. deleting kind3 and kind4 from index1

It goes without saying, backup your indexes 1st, and please report back if it works : )

You are going to waste a lot of space though, deleting data from an index doesn't free up space, it just marks it as deleted.

Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...