Hello there,
I just wonder if I can divide an index into two indexes.
e.g, Divide the data in index=main to index=production and index=text
Thank you.
既にIndex化されたデータ(Index1)を、途中で二つのindex(Index1とIndex2)に分けることは可能でしょうか。
例:index=mainに入っているデータを、途中でindex=production と index=testに分ける
If you wanted to split the main index in half, here is what you'd do with an out of the box install:
If you wanted to split the main index in half, here is what you'd do with an out of the box install:
Well, my suggestion was to move, not copy, the data. If you move it, you're not making duplicates because each index would only have a single copy of it, with half the buckets in test and half in production. Of course, you would need to adjust your inputs and/or props/transforms to ensure the data inputs you'd like are routing to production.
I understand that it is not possible to re-index the data which has been already indexed. I guess I should delete the data and create new indexes to divide them.
This solution creates a duplicate of the index in each of the new indexes, it does not separate them. Data that has been indexed cannot be altered.
You will have problems going forward, because all new data will be placed into Main unless you redirect the data to the desired index.
Thank you.
So, it's possible to divide the index which has already indexed once, right? I'm bit confused since linu1988 below says it's not possible.....
Hello,
You could create two separate indexes. Use COLLECT command to pass that info into your required indices. But it will not be possible to divide the index further once it is created and data is in them. Before passing the events to the new indexes please read the documentation.
_http://docs.splunk.com/Documentation/Splunk/6.0.1/searchreference/collect