I am using collect command to transfer data data from one index to another index
The query is like index=A source=sourceA sourcetype:sourcetypeA host=hostA | collect index=B source=sourceA sourcetype:sourcetypeA host=hostA.
But some data is missing why
Can we have any other command to transfer one index data into another index
Is it possible to re-ingest the data to the new index? Other than that, the collect command should do the trick.
What sort of data is missing?
Have you tried using output_format=hec for the collect command
https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Collect#arg-options
I am getting events properly but the total number of A events not matching the B events
Can you find some information around the missing data - e.g. does it transfer a fixed number of events, but miss some others.
Are the time stamps the same and is the time window you are searching the same on both indexes?