Notify Splunkd about a new index after move

[joonradley]

Hi,

In my cold to frozen script I copy the bucket to another server. The second server is used to access the older entries for forensic investigation. The buckets are copied from cold on the main server to cold on the secondary server.

In order for Splunk to see the new buckets I need restart Splunk. Needless to say that this is less than optimal.

Is there a REST API command that I can issue that will instruct Splunkd on the secondary server to load the new bucket?

Thx

Joon

[lpolo]

I have the same problem but only with hot buckets. It will be nice to find out if it possible to move hot buckets without restarting splunk.
I have been able to move cold or warm buckets form one server to another server where the index name is the same on both servers.

[lpolo]

It will be nice to find out it this is possible. I have the same problem.