Reporting

Unable to Export Events from Cmd line

richnavis
Contributor

I am attempting to move data from one index to another. I've read that the way to do this is to export the events you want to move, then import them using the Export and Import commands. However, when I attempt to export the commands, I get an error. Here's my syntax and error:

splunk export eventdata -index IISLOGS -host WWW01 -dir f:\temp

Failed cli cmd export

Anyone know what is causing this?

Tags (2)
0 Karma

Lowell
Super Champion

Have you looked into using exporttool and importtool? Another option is to simply move an entire bucket. (You have to be careful to use a bucket id that's not already in use.

You may find this answer useful:

0 Karma

richnavis
Contributor

yah.. turns out that you need to stop splunkd to run this command.. doh!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...