Reporting

Error when importing event data

tonopahtaos
Path Finder

Hi,

I want to export event data from one indexer and import them to another indexer.

I used following command to export event data under 'main' index to a folder called 'events' under /tmp:

/opt/splunk/bin/splunk export eventdata -index main -dir /tmp/events

It has no problem.

Then I created an NFS share for 'events' folder and mounted it to my second splunk indexer machine. I can use 'ls /mnt/events' to see all files remotely.

Then I used following command to import event data:

./splunk import eventdata -index main -dir /mnt/events

I got following error:

The subcommand 'eventdata' is not valid for command 'import'.

What is the problem here? Why 'eventdata' is invalid during import when it is valid during export?

0 Karma

hexx
Splunk Employee
Splunk Employee

The splunk import command actually only supports the userdata subcommand - it is not designed to import event data. I have filed a documentation bug (reference SPL-56401) to clarify this fact in the CLI help.
In my opinion, the best way to merge two indexes together is described in this Wiki topic - please pay special attention to the "Scrubbing the bucket IDs" section! - and this Splunk Answer. And this one, too.

dart
Splunk Employee
Splunk Employee

If you're trying to move a whole index, you can just move the index itself

You can also rebuild an index if you need to merge data. Let me know if you need to.

tonopahtaos
Path Finder

I want to move the data from one indexer to another one by merging them with existing data.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...