Copy Indexed data from one index to another index

[bharathkumarnec]

Hello All,

We have two indexes, old one is ABC and new one is DEF, ABC has ~100GB data, we wanted to move the data to DEF.

Can we copy ABC buckets and pasted under DEF index??
If so, will it consume additional license for DEF as well??
Is it recommended to do such a copy if needed??

Help in this regard is highly appreciated.

Thanks in advance!

BK

[HiroshiSatoh · Accepted solution]

Copying is okay. It does not consume license.
However, if there is hot buckets, Splunk will not start so please change hot buckets to warm buckets.

Hot bucket will be warm bucket on restart. Or You can also change it with a command.
https://www.batchworks.de/manually-roll-buckets-from-hot-to-warm/