Getting Data In

How to re-ingest data between two independent Indexers ?

vikrantc
New Member

We have a Splunk setup with HF, Indexers in Cluster with one search head (SH).

**We do not have control on Indexers and SH as it is managed by other vendor

We forward data to Indexers (On which we do not have control) now we need to archive the logs in our environmnet and are planning to use Splunk Indexer for same. Our HF will send a copy of data to Log Archiver (Indexer) and one copy to Vendor Indexer.

As per requirement vendor may need old data which is present in Log Archive (Indexer) on adhoc basic.

My question is how do we re-ingest the data from Log Archive (Indexer) to vendor Indexer so that they can analyse the data received from log archive (indexer).

Tags (1)
0 Karma

sundareshr
Legend

The only thing you can do is to find the original data and export it to a flat file, and then re-index it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...