Knowledge Management

Issues moving data from one index to another

byu168
Path Finder

I was attempting to move events from one index to another using this command

index=main host=gpm source=/var/log/gpm/gpm.log | collect index=gpm sourcetype=gpm

I checked the initial search to verify all the events I want are there, however, after running the entire command and checking index=gpm there are no events stored in it. gpm is a newly created index that has no events in it at all. Is there any reason that this issue is occurring?

0 Karma
1 Solution

byu168
Path Finder

I wasn't able to figure out the cause of the issue, however, since the size of data I was moving was relatively small I found it easier to simply reindex the data

View solution in original post

0 Karma

woodcock
Esteemed Legend

If you are moving 100% of the contents of the index, you can easily just rename it from the OS. You need to stop splunk, find the indexes.conf file that contains the current index definition, change the name of the index there, go find the directory on disk and change the name there, too, then restart splunk.

0 Karma

byu168
Path Finder

Thanks for the information! I was selectively moving data but this information could be useful in the future.

0 Karma

byu168
Path Finder

I wasn't able to figure out the cause of the issue, however, since the size of data I was moving was relatively small I found it easier to simply reindex the data

0 Karma

ddrillic
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...