Knowledge Management

dump command - indexer cluster question

fisuser1
Contributor

We want to extract existing data (very little, less than a GB) from an index. Is there a best practice for running the dump command on an indexer cluster (3 nodes) for a specific index? Do I have to run this command individually on each indexer in the cluster to ensure all data in the cluster is extracted properly?

Tags (2)
0 Karma
1 Solution

fisuser1
Contributor

Thanks for the response @koshyk. The data size was a bit larger than I expected, so I rean the dump command on all indexers and imported them. Seemed to do the trick. Thanks again for the suggestion though!

Commands:
Dump:
/opt/splunk/bin/splunk search 'index=my_old_idx latest="05/23/2019:11:33:55" | dump basefilename=my_old_idx.log'; find /opt/splunk/var/run/splunk/dispatch//dump/ -type f -name 'my_old_idx .log' | xargs -I {} mv {} /opt/splunk/etc/slave-apps/new_app_here

Import:
find /opt/splunk/etc/slave-apps/new_app_here/ -type f -name 'my_old_idx.log*' | xargs -I {} /opt/splunk/bin/splunk add oneshot {} -sourcetype my_new_st_here -index my_new_idx -rename-source /dir/foo/bar

View solution in original post

fisuser1
Contributor

Thanks for the response @koshyk. The data size was a bit larger than I expected, so I rean the dump command on all indexers and imported them. Seemed to do the trick. Thanks again for the suggestion though!

Commands:
Dump:
/opt/splunk/bin/splunk search 'index=my_old_idx latest="05/23/2019:11:33:55" | dump basefilename=my_old_idx.log'; find /opt/splunk/var/run/splunk/dispatch//dump/ -type f -name 'my_old_idx .log' | xargs -I {} mv {} /opt/splunk/etc/slave-apps/new_app_here

Import:
find /opt/splunk/etc/slave-apps/new_app_here/ -type f -name 'my_old_idx.log*' | xargs -I {} /opt/splunk/bin/splunk add oneshot {} -sourcetype my_new_st_here -index my_new_idx -rename-source /dir/foo/bar

koshyk
Super Champion

For low amount of data, it is much better to do an outputlookup of the data via GUI. So you don't have to worry about nodes etc

index=whateverindex sourcetype=somesourcetype | table index,host,sourcetype,_raw| outputlookup dataoutput.csv

Then copy this dataoutput.csv for your purposes (or select relevant field)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...