topic How to downgrade Splunk 6.4 to 5.0? A config file was overwritten and I didn't do a backup. in Installation

How to downgrade Splunk 6.4 to 5.0? A config file was overwritten and I didn't do a backup.

naresha — Fri, 24 Jun 2016 01:51:53 GMT

I have upgraded Splunk 5.0 to 6.4 and forgot to take a backup where a config file got overwritten, let me know if the below steps will help in restoring...

Un-install Splunk – 6.4 Install
older version 5.0 Try mapping Index’s
that were existing from previous
version Check configuration to see
where applications are discovered

Looking forward for support on helping me in fixing the current situation!!

Re: How to downgrade Splunk 6.4 to 5.0? A config file was overwritten and I didn't do a backup.

maciep — Sat, 25 Jun 2016 13:16:51 GMT

This certainly isn't my wheelhouse, but you might want to elaborate a bit on situation. Is this a single server environment? Which conf file was overwritten? How do you plan to get it back by downgrading? What is the actual state of your environment at the moment?

I mean, sure, you can uninstall 6.4 and install 5.0. But without knowing what problems you're actually trying to address from the upgrade, I imagine it will be hard for others to advise you on whether those steps make sense.

Re: How to downgrade Splunk 6.4 to 5.0? A config file was overwritten and I didn't do a backup.

ddrillic — Sun, 26 Jun 2016 21:52:46 GMT

If you elaborate on the issue, it would be great. If you follow the best practices and create your own copies of the config files under the local sub-directories, you should be fine.

More about it at - Update from 6.0 to 6.0.1