Deployment Architecture

Move data to another index based on _time

zafunt
Explorer

I would like to move data based on the event time to another index. I've tried something like the following...

index=main _time < whatever | collect index=old

But, this changes all the src values to be the splunk indexer.

I've also tried to move items to "frozen" based on time. However, that seems to move events based on the time that the data was indexed.

Is there another way to do this?

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

move the buckets instead, it's easier to identify all the buckets containing your data.
then copy/move then to the new index.

  • use the |dbinspect index=main | convert ctime(endEpoch) AS start| convert ctime(startEpoch) AS end | table path state start end
    to get the list of your buckets, with their timerange.

  • stop splunk

  • copy or move them to the new indexpath

  • if needed, use the delete command to hide the events that you do not want

View solution in original post

yannK
Splunk Employee
Splunk Employee

move the buckets instead, it's easier to identify all the buckets containing your data.
then copy/move then to the new index.

  • use the |dbinspect index=main | convert ctime(endEpoch) AS start| convert ctime(startEpoch) AS end | table path state start end
    to get the list of your buckets, with their timerange.

  • stop splunk

  • copy or move them to the new indexpath

  • if needed, use the delete command to hide the events that you do not want

zafunt
Explorer

Thanks. This should work for me. I'll update with any additional steps that may be helpful to others.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...