Exporting data and importing into another Splunk instance

[CSReviews]

I am planning on teaching others how to use Splunk to search through data, similar to the Splunk boss of the soc challenges-

https://github.com/splunk/botsv3

Similarly, I would like to export the data I generated in my Splunk instance to then have students import into there's to follow along. The only way I can figure out how to do this is from running a search and using the export feature. Is there a recommendation for this? 

[isoutamo]

Hi

there some apps, which you could use to generate continuously sample data. Probably mostly used is eventgen https://splunkbase.splunk.com/app/1924. 

One option is just e.g. tar that index and untar it on target systems. Of course you need to do also app for defining it on those target systems. This needs that those nodes are enough equal like same Linux etc. If I recall right something like this was done for those older bots datasets?

r. Ismo

[splunkreal]

Hello @CSReviews you can export as csv file it's then easy to import.

https://hurricanelabs.com/splunk-tutorials/ingesting-a-csv-file-into-splunk/

"Upload with Splunk Web"