我有一个Splunk服务器,其中包含650k事件的索引数据。我想将整个数据从一个实例迁移到另一个新实例。 我尝试使用带有数据字段的迁移脚本-27D@d但我只能迁移50k数据。 -27D@d是初始数据可用的点。 你能帮我吗? 代码如下:
import splunklib.client as client
import splunklib.results as results
import json
import requests
send_string = ""
service=client.connect(host="host1", port=8089, username="admin", password="xxxx")
rr = results.ResultsReader(service.jobs.export('search index=my_index latest=-27D@d' ))
for result in rr:
if isinstance(result, results.Message):
continue
elif isinstance(result, dict):
final = dict(result)
data = final['_raw']
send_string = json.dumps({"event" : data,"source" : "test"},ensure_ascii=False).encode('utf8')
url='http://host2:8088/services/collector'
authHeader = {'Authorization': 'Splunk 5fbxxxx'}
#Send data to Splunk
response = requests.post(url, headers=authHeader, data=send_string, verify=False)
if response.status_code == 200:
print("Successfully pushed the data to Splunk source")
else:
print("Failed to push the data to Splunk source")
如果host2上不存在索引my_index,则只需将目录$SPLUNK\u DB/my_index复制到host2,将my_index添加到index.conf,然后重新启动SPLUNK
相关问题 更多 >
编程相关推荐