Getting Data In

How to copy indexed data from one index to another index in smartstore enabled cluster

bsrikanthreddy5
Path Finder

I have a requirement to move indexed data from index-A to another index-B in a smart-store enabled cluster. Both indexes (A & B ) has data in the AWS s3-bucket.  I would like to know if the below steps works?

Steps :

  1. Stop the incoming data to index-A
  2. Roll the hot bucket  on index-A
  3. Move  the data from s3 for index-A  to index-B
    1. Using the aws s3 sync  s3://bucket-name/index-A  s3://bucket-name/index-B  
  4. Run bootstrap command on CM.
Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

One cannot move data from one index to another.  Once the data is in an index it stays there until it ages out or is removed to make room for newer data.

NEVER mess with Splunk's S3 buckets.  Do so at your own risk and be prepared for a Bad Day.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...