Knowledge Management

How can I move logs from one index to another?

rharden
New Member

We recently moved several different logs that were in the "main" index to a newly-created index in order to organize our data on our lun a little better. I'm wondering if there is a way to move data to another index, or if it is even possible to do so. I've seen other questions that were answered on this topic, but most of them seemed to have been on a much older version. We are currently running 6.3.3 and I'm wondering if there is a recommended way to do this currently.

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There is no general way of moving data from one index to another. Just let the data age out and continue with correct indexes from today on.

Alternatively, you could re-index the older data into the new index.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Same way you originally indexed it.

Alternatively, you can manually load data something like this:

$SPLUNK_HOME/bin/splunk add oneshot path -index foo -host bar -sourcetype meh

Make sure to read ./splunk help add oneshot first.

0 Karma

rharden
New Member

Thanks for the answer;
How could I re-index the older data into a new index?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...