Getting Data In

Can I thaw an archive into a different index than it was created

solarboyz1
Builder

Is it possible to thaw an archive into a different index than it was initially created.

This is for Splunk 4.2+ archives.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

yes, buckets can be moved from an index to another.

the only thing to be careful of is to avoid bucket id duplicates between the existing buckets and the thawed ones.
see http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...