Getting Data In

What is the best way to upload exported Splunk data into another Splunk instance?

aoliullah
Path Finder

Hi. I have tried to export large number of events from a Splunk instance to another instance to work with the data (i.e.create dashboards etc). When I tried to upload the exported csv file into the Splunk instance, it looks messed up in the data preview. They are all from known sources (i.e. iis data, win event logs etc). How do i correct this? Or is there any better way to do it?

0 Karma
1 Solution

DalJeanis
Legend

If you want the data to look exactly the same, you really need to have it ingested in the same way. That means your target machine must have all the same configurations to extract and transform the data.

Also, make sure that you are exporting the _raw, as opposed to a formatted CSV file of the pre-chewed information.

Here's a useful link -
https://answers.splunk.com/answers/88107/export-index-data-from-production-splunk-and-import-intotes...

Here's a very in-depth explanation and cookbook, which you may or may not be able to follow completely depending on how much authority you have in the two systems -
https://answers.splunk.com/answers/25174/how-to-export-import-events-from-indexes.html

View solution in original post

aaraneta_splunk
Splunk Employee
Splunk Employee

@aoliullah - Did the answer provided by DalJeanis help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

DalJeanis
Legend

If you want the data to look exactly the same, you really need to have it ingested in the same way. That means your target machine must have all the same configurations to extract and transform the data.

Also, make sure that you are exporting the _raw, as opposed to a formatted CSV file of the pre-chewed information.

Here's a useful link -
https://answers.splunk.com/answers/88107/export-index-data-from-production-splunk-and-import-intotes...

Here's a very in-depth explanation and cookbook, which you may or may not be able to follow completely depending on how much authority you have in the two systems -
https://answers.splunk.com/answers/25174/how-to-export-import-events-from-indexes.html

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...