Deployment Architecture

Migrate from one index to another index with data integrity control

lyukai
New Member

Hi All,

I recently have a new requirement to turn on data integrity control for a index ("X"). However, as the index already has data, I have to create a new index ("Y") and index incoming data into Y.

i read, https://answers.splunk.com/answers/32176/is-it-possible-to-migrate-indexed-buckets-to-a-different-in... but i'm not sure i can do this as the new index has data integrity control.

any advice on the best way i can migrate historical data from X to Y?

Thanks a million!

Best Regards,
Eric

0 Karma

davpx
Communicator

Have you thought about simply renaming the index and turning on data integrity control? After that you should be able to regenerate the hashes.

If this isn't an option for you, you'll have to replay the historical data from your forwarders by clearing the fishbucket once pointed to the new index, if that data it still exists.

https://answers.splunk.com/answers/28134/rename-an-index-in-4-1-8.html
https://docs.splunk.com/Documentation/Splunk/7.0.1/Security/Dataintegritycontrol#Regenerate_hashes

0 Karma

mayurr98
Super Champion
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...