topic Move index from one server to another in Getting Data In

Move index from one server to another

joxley — Tue, 17 Nov 2015 09:23:20 GMT

I have an index on server-a called wifi that data is going into continuously. I want to move that index onto server-b. There is currently only one input coming into the index.

My plan is

Create index wifi on server-b
Point the input to server-b
Roll index on server-a to warm
Copy server-a:$SPLUNK_DB/wifi to server-b:$SPLUNK_DB/wifi

Is there any chance of bucket collision?

Re: Move index from one server to another

dgrubb_splunk — Tue, 17 Nov 2015 13:32:27 GMT

Since Server B will be ingesting data and creating buckets prior to your move of buckets from server a, I would say the potential to have a bucket conflict is still there.

Re: Move index from one server to another

renems — Tue, 17 Nov 2015 16:17:17 GMT

Agree with dgrubb. This is not recommended as you can cause bucket collision.
The safest way is obviously by cutting the data input from the forwarder to the indexer. If your copy won't take too long (how large is the index currently?), this might be the easiest way. Your forwarder can queue the data for a while, before it looses data. If you like, you can enlarge the forwarders queue to make sure that it won't overflow. Fire it up as soon as you're done copying, and you should be allright.

Re: Move index from one server to another

ChrisG — Tue, 17 Nov 2015 17:04:24 GMT

I agree with dgrubb and renems - to avoid bucket conflict, you should turn on indexer acknowledgment on your forwarders and queue the data there while you make the move. See Protect against loss of in-flight data in the Forwarding Data manual.

When you make the move, follow the procedure in the Managing Indexers and Clusters of Indexers manual: Move the index database.