×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
javier_oshiro
Engager
Member since: ‎11-02-2023
3 weeks ago
Community Statistics
Posts 2
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎11-02-2023
Activity Feed
View All

Re: How to move data from one indexer to another?

by in Splunk Enterprise
‎10-01-2025 10:32 AM
‎10-01-2025 10:32 AM
Hi, thanks for the reply. We have two indexers, they should have the same data for some indexes as we are forwarding this data to both destinations. One of them had a problem and we noticed it lost some data (lets call it A), and we also noticed the other indexer has the lost data (lets call it B). The situation now is that B has some data that should be on A but it is not, and we want to fill the gaps. We are trying to figure out how should we approach the copy of the data from the indexer that has the data to the other one that lost the data. ... View more

How to move data from one indexer to another?

by in Splunk Enterprise
‎10-01-2025 09:03 AM
‎10-01-2025 09:03 AM
We are currently trying to recover some lost data on one indexer. The manual recovery process is long enough that we are evaluating automated or scripted alternatives. This data is available on another indexer on a different instance and the indexers are not clustered. They are two different indexers. Since the indexers are completely different instances the buckets are not identical we cant use rsync or manual copy of the buckets to recover this data. How would you sync different indexers and copy/collect only the data that is missing on the destination? ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
3 weeks ago
Karma given to
View All