topic Re: How do I move VER.9.0.2 data to Ver.7.3.3? I cover it up? in Splunk Enterprise

How do I move VER.9.0.2 data to Ver.7.3.3? I cover it up?

minpd0309 — Tue, 21 Feb 2023 02:51:48 GMT

Can I overwrite the data I accumulated in Ver.9.0.2 Enterprise to Ver.7.3.3 Enterprise?

Re: How do I move VER.9.0.2 data to Ver.7.3.3? I cover it up?

minpd0309 — Tue, 21 Feb 2023 03:27:40 GMT

please answer me T . T TTTTTTTTTTTTTTTTTTT

Re: How do I move VER.9.0.2 data to Ver.7.3.3? I cover it up?

scelikok — Tue, 21 Feb 2023 06:01:52 GMT

Hi @minpd0309,

It depends on indexes.conf configurations. The most critical parameters are below;

indexes.conf tsidxWritingLevel = [1|2|3] 7.3.3 default is 1 9.0.2 default is 3 journalCompression = gzip|lz4|zstd 7.3.3 default is gzip 9.0.2 default is zstd

If you are using 9.0.2 defaults on your 7.3.3 you can try. But if not unfortunately you cannot copy.

If parameters are the same, it is better to try on a seperate test server first.

Re: How do I move VER.9.0.2 data to Ver.7.3.3? I cover it up?

PickleRick — Tue, 21 Feb 2023 08:46:00 GMT

Adding to @scelikok 's answer - you can't (or at least not without some heavy splunk internal developer level magic) convert index file from a higher tsidx level to a lower one.

7.3.x does support tsidx levels of 1, 2 and 3 whereas 9.0.x supports 1, 2, 3 and 4. If your 9.0.2 indexes are configured with the default level of 3, you _might_ be able to move your data.

Having said that - why would you want to use so obsolete version which has no support and lacks many features?