Getting Data In

Transfering data from one index to another

linu1988
Champion

Hello Everyone,
Is there any functionality in splunk to tranfer event from one to other index source/sourcetype wise? It would help with negating rework/data loss.

Thanks

Tags (2)
0 Karma

lguinn2
Legend

Sorry. The only thing you can do is to find the original data and export it to a flat file, and then re-index it as desired. I don't think this is what you wanted, but AFAIK there is no way to transfer data from one index to another.

lguinn2
Legend

This is not necessarily easy or desirable for Splunk - as Splunk is not a DBMS.

0 Karma

linu1988
Champion

No this is not what i want or many want. This would be another hottest release for future splunk release with some more enhancement which i think is not at all good and requires so much effort for simple things.

Btw like always love to hear from you Guru's, Learn so much just from reading your comments

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...