Exporting 90+ GB from an index

[sf_user_199]

It looks like I may need to export an entire index, which is roughly about 90 GB.

Best I can come up with is to use | table _raw | outputcsv or the CLI export tool. This index is all apache access logs.

Will this cover my needs, or is there some other method I should use to pull all this data.

My other alternate solution is to setup a special Splunk instance that does not have a data expiration policy set - would there be a way to move the index data from it's current location to this new server?

[gkanapathy]

You could use the coldToFrozen script to roll the entire expired bucket to a new Splunk instance, yes. (The script can perform any action, but presumably you'd somehow copy the bucket to the destination instance's thaweddb folder.) Alternatively, if you haven't already done this, you can add a large network volume for the Splunk colddb buckets, and just keep them online in the same instance.

The same script could be used to export the data using "exporttool".