Solved: Tar'ing index so that it is distributable to other... - Splunk Community

Splunk Search

[1] I would like to know if I can tar an index from a Splunk instance and then untar it into other Splunk instance?

[2] Would untar'ing the index overwrites the already existing events of that other Splunk instance?

1 Solution

Solution

Yes you can.
Copy it to a new index instead and it won't. If you are trying to merge index contents, then you should only copy individual buckets (i.e. exclude index-level metadata), and make sure the bucket ID numbers are changed so there are no conflicts. Or delete the old index first if you are not trying to merge.

View solution in original post

Solution

Yes you can.
Copy it to a new index instead and it won't. If you are trying to merge index contents, then you should only copy individual buckets (i.e. exclude index-level metadata), and make sure the bucket ID numbers are changed so there are no conflicts. Or delete the old index first if you are not trying to merge.

Thanks! I'll try this out.

Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...