Splunk Enterprise

Copy the indexed bucket to another index path

splunker12er
Motivator

Is it possible for me to copy the specific Index bucket to another Index path,

Eg:
I want to copy the indexed data from index name 'My-Index-Name-1' to 'My-Index-Name-2'
Just by cut and copy the bucket to new index path, will work ?

Search query: (will this work , after copy ?)

index=My-Index-Name-2 | table _raw

Details:

Index Name ->My-Index-Name-1
State -> Warm
Path -> /opt/splunk/var/lib/splunk/My-Index-Name-1/db/db_1403947472_1403779602_8
Tags (3)
0 Karma

lguinn2
Legend

This is risky to do, as each bucket in an index has an identifier that is unique to that index. If you copy a bucket to a different index, you will almost certainly cause a collision of bucket ids, which will cause errors.

It is safer to simply re-index the data, placing in the index where you want it to go.

If you have a deep understanding of how buckets and indexes are organized, you might consider how you could use tools like rebuilding buckets. But I am sure that Splunk Support would recommend against it.

splunker12er
Motivator

I do need carefully select the selective Warm dbs and move to the new index folder , and check for bucket_id clash. if any I do need to modify the range accordingly and run the below command :

 ./splunk _internal call /data/indexes/MY-INDX-NAME/rebuild-metadata-and-manifests

doing so, I can be successful in moving the indexed data from one index to another index. (my case i want the data to be searched in the other index name)
Am i fine with the understanding? please correct me , if i am wrong.

0 Karma

splunker12er
Motivator

whether the index name also stored along with the indexed data ? Or it depends on the path where the index resides ?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...