https://community.splunk.com/t5/Splunk-Enterprise/What-is-Best-Practice-to-move-data-from-one-indexer-to-another/m-p/604582#M13175 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/226206">@SplunkySplunk</a>,</P><P>as you can find in&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Moveanindex#:~:text=You%20can%20move%20the%20index,default%20location%2C%20created%20during%20installation" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Moveanindex#:~:text=You%20can%20move%20the%20index,default%20location%2C%20created%20during%20installation</A>.</P><P>the steps are the following:</P><UL><LI>install on Azure the same version of your on-premise Splunk,</LI><LI>copy all the apps in the new enviuronment, with special attention to the ones containing indexes.conf files,</LI><LI>with a down Splunk (in both systems) copy the content of your SPLUNK_DB folder (containing indexes) in the relative folder in Azure,</LI><LI>restart Splunk on Azure.</LI></UL><P>If you have Linux both on on-premise and Azure, you could also copy the entire Splunk folder, so in this way you copy all the configurations.</P><P>If you have Windows, you have to install the new machine anche copy two folders:</P><UL><LI>$SPLUNK_HOME\etc</LI><LI>the $SPLUNK_DB folder</LI></UL><P>One final hint, if possible, avoid Windows OS for production systems.</P><P>Ciao.</P><P>Giuseppe</P> Wed, 06 Jul 2022 12:35:02 GMT gcusello 2022-07-06T12:35:02Z https://community.splunk.com/t5/Splunk-Enterprise/What-is-Best-Practice-to-move-data-from-one-indexer-to-another/m-p/604562#M13174 <P>Hello<BR />I have an on prem indexer which i want to shot down and move all his context to another indexer is Azure<BR />What is the best practice for that ?</P> <P>Thanks</P> Thu, 07 Jul 2022 14:13:35 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-is-Best-Practice-to-move-data-from-one-indexer-to-another/m-p/604562#M13174 SplunkySplunk 2022-07-07T14:13:35Z https://community.splunk.com/t5/Splunk-Enterprise/What-is-Best-Practice-to-move-data-from-one-indexer-to-another/m-p/604582#M13175 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/226206">@SplunkySplunk</a>,</P><P>as you can find in&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Moveanindex#:~:text=You%20can%20move%20the%20index,default%20location%2C%20created%20during%20installation" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.0/Indexer/Moveanindex#:~:text=You%20can%20move%20the%20index,default%20location%2C%20created%20during%20installation</A>.</P><P>the steps are the following:</P><UL><LI>install on Azure the same version of your on-premise Splunk,</LI><LI>copy all the apps in the new enviuronment, with special attention to the ones containing indexes.conf files,</LI><LI>with a down Splunk (in both systems) copy the content of your SPLUNK_DB folder (containing indexes) in the relative folder in Azure,</LI><LI>restart Splunk on Azure.</LI></UL><P>If you have Linux both on on-premise and Azure, you could also copy the entire Splunk folder, so in this way you copy all the configurations.</P><P>If you have Windows, you have to install the new machine anche copy two folders:</P><UL><LI>$SPLUNK_HOME\etc</LI><LI>the $SPLUNK_DB folder</LI></UL><P>One final hint, if possible, avoid Windows OS for production systems.</P><P>Ciao.</P><P>Giuseppe</P> Wed, 06 Jul 2022 12:35:02 GMT https://community.splunk.com/t5/Splunk-Enterprise/What-is-Best-Practice-to-move-data-from-one-indexer-to-another/m-p/604582#M13175 gcusello 2022-07-06T12:35:02Z