Splunk Database copy to new_instance

DataUser007 — Thu, 28 Sep 2023 10:49:59 GMT

I have a windows server and it's OS got crashed but i have the splunk database in the another drive which is fine now the steps I have performed are in the new splunk installation are:

1. Copied the configurations of the previous splunk application from the backup i have in to the new application.

2. Changed the database location and created the database structure in another drive apart from C: drive.

3. Now from the earlier database i copied the indexed data in to the new data base where i have overwritten the already present indexes which are created as per the indexer configuration.

4. Now when i restart the splunk i am getting a "DIRTY_DATABASE File (.dirty_database)" file generated.

5. But i can see the data in the indexes when i ran a search

So, the question is whether the procedure i followed is correct or is there any other way to do this

Thanks,

Your well wisher

Re: Splunk Database copy to new_instance

isoutamo — Fri, 06 Oct 2023 06:32:00 GMT

here is link how to move index database to the nee location https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Moveanindex

When I need to move db to the new node I have followed this https://community.splunk.com/t5/Installation/How-to-migrate-indexes-to-new-indexer-instance/m-p/528064/highlight/true That was for linux node, but you can do same procedure with windows with small changes to used commands.

Copy data + configurations to correct place
1. As you are moving SPLUNK_DB to a new directory, you must update correct parameters (see docs link)
Install fresh splunk (same version than in old node)
Start splunk
Check that all is ok
Update to the latest/needed version

r. Ismo

topic Re: Splunk Database copy to new_instance in Splunk Enterprise

Splunk Database copy to new_instance

Re: Splunk Database copy to new_instance