Tar'ing index so that it is distributable to other Splunk instance

[Nicholas_Key]

[1] I would like to know if I can tar an index from a Splunk instance and then untar it into other Splunk instance?

[2] Would untar'ing the index overwrites the already existing events of that other Splunk instance?

[gkanapathy · Accepted solution]

1. Yes you can.
2. Copy it to a new index instead and it won't. If you are trying to merge index contents, then you should only copy individual buckets (i.e. exclude index-level metadata), and make sure the bucket ID numbers are changed so there are no conflicts. Or delete the old index first if you are not trying to merge.

[Nicholas_Key]

Thanks! I'll try this out.