Reporting
Highlighted

Exporting 90+ GB from an index

Path Finder

It looks like I may need to export an entire index, which is roughly about 90 GB.

Best I can come up with is to use | table _raw | outputcsv or the CLI export tool. This index is all apache access logs.

Will this cover my needs, or is there some other method I should use to pull all this data.

My other alternate solution is to setup a special Splunk instance that does not have a data expiration policy set - would there be a way to move the index data from it's current location to this new server?

Tags (2)
0 Karma
Highlighted

Re: Exporting 90+ GB from an index

Splunk Employee
Splunk Employee

You could use the coldToFrozen script to roll the entire expired bucket to a new Splunk instance, yes. (The script can perform any action, but presumably you'd somehow copy the bucket to the destination instance's thaweddb folder.) Alternatively, if you haven't already done this, you can add a large network volume for the Splunk colddb buckets, and just keep them online in the same instance.

The same script could be used to export the data using "exporttool".

0 Karma