- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unable to Export Events from Cmd line

richnavis
Contributor
07-20-2011
03:11 PM
I am attempting to move data from one index to another. I've read that the way to do this is to export the events you want to move, then import them using the Export and Import commands. However, when I attempt to export the commands, I get an error. Here's my syntax and error:
splunk export eventdata -index IISLOGS -host WWW01 -dir f:\temp
Failed cli cmd export
Anyone know what is causing this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Lowell
Super Champion
07-21-2011
11:35 AM
Have you looked into using exporttool
and importtool
? Another option is to simply move an entire bucket. (You have to be careful to use a bucket id that's not already in use.
You may find this answer useful:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richnavis
Contributor
07-20-2011
04:22 PM
yah.. turns out that you need to stop splunkd to run this command.. doh!
