Deployment Architecture

How can I move one index data from production to test environment for testing purpose?

riqbal47010
Path Finder

I have single instance test environment. How can I move one index data from productio to test environment for testing purpose.

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
if you do not want to mask your production data to be used for the test, you could connect your test server as a Search Head of your indexers and use the production data for your tests (I am an auditor and shudder all by myself thinking of my suggestion!).

Otherwise you could perform a search on your index taking all the data of the period you are interested in and export them as a row data in a text file that you can then import on your test server (maybe masking them); in this way however you have license consumption.
The ideal of security would be to perform the extraction-level masking!

Ciao.
Giuseppe

riqbal47010
Path Finder

this below post answer seems answering my question.

https://answers.splunk.com/answers/771891/splunk-test-environment.html?utm_source=typeahead&utm_medi...

althrough yours as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...