Reporting

How to move events between Splunk instances without moving entire buckets?

wegscd
Contributor

Is there a good way to move events between Splunk instances (besides moving entire buckets)?

I'm working on some dashboards with someone outside our enterprise, so them accessing our indexers is not a possibility. I've tried do a search to extract the test data, use the table command to show the _time and _raw fields, and export that as a CSV.

That works for some stuff, but the import fails if the events are multiline.

Moving entire buckets is not a good solution: there is a lot of data in that index that is irrelevant to the recipient.

0 Karma

Lucas_K
Motivator

Do you have network connectivity to forward the events as udp?

You could use the cef app (with a custom udp mod).

Make a relevant search that matches the events you want to forward to your 3rd party.
Add that into a data model.
Create your cef rule.
Modify it as udp.
Forward udp to 3rd party.

fyi, udp is used as you can bypass creation of the cef field translation and send out raw events.

0 Karma

hortonew
Builder

You could try the steps here: https://answers.splunk.com/answers/25174/how-to-export-import-events-from-indexes.html

It's an older post, so please report back if it still works.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...