topic Re: Installing a new Splunk server and restoring data from another splunk server in Installation

Installing a new Splunk server and restoring data from another splunk server

leobsksd — Thu, 01 Feb 2024 21:35:32 GMT

I am installing a new Splunk server on Windows using the trial subscription for now, which may be changed to the free license later.

I have data from another Splunk for Windows server that I would like to restore to the new instance. What is the process for doing that?

Thanks,

Leo

Re: Installing a new Splunk server and restoring data from another splunk server

leobsksd — Fri, 02 Feb 2024 00:25:00 GMT

I found this: Migrate a Splunk Enterprise instance from one physical machine to another - Splunk Documentation

I will give it a try.

Leo

Re: Installing a new Splunk server and restoring data from another splunk server

gcusello — Fri, 02 Feb 2024 09:16:06 GMT

Hi @leobsksd,

do you want to migrate only configurations or also data?

For configurations, you have to copy from the old instance to the new one all the apps you installed and eventually also search and launcer, if you have some configuration in these apps.

if you want also migrate data, you have to:

stop bothe the instances,
copy the $SPLUNK_HOME\var\lib\splunk folder (or a different one if you used a different $SPLUNK_DB) from the old to the new instance,
copy all the indexes.conf files from the old to the new instance,
restart Splunk in the new instance.

Only for conclusion: Windows is ok for quick tests or demo, avoid for production systems, use Linux!

Ciao.

Giuseppe

Re: Installing a new Splunk server and restoring data from another splunk server

leobsksd — Fri, 02 Feb 2024 15:51:00 GMT

I will try standing up a new instance of Splunk and copying over the $SPLUNK_HOME\var\lib\splunk folder to the new installation from the instance of Splunk that I have backed up.

Will this also copy over the configuration from the old server? Part of the issue is that the old server had a free license which is violation, which is why I am working to setup a new Splunk server without that problem.

Good point about Linux. I may try installing Splunk on that platform and see how it does.

Leobsksd

Re: Installing a new Splunk server and restoring data from another splunk server

gcusello — Fri, 02 Feb 2024 15:55:22 GMT

Hi @leobsksd,

you have to copy the apps and data, not all the etc folder , especially license!

I suppose that you want to install on a different computer or a different VM, not on the same instance in violation, it will not work: on Windows you cannot reinstall Splunk on the same server, instead on linux you can install in a different folder, eventually deleting the old one without problems.

Ciao.

Giuseppe

Re: Installing a new Splunk server and restoring data from another splunk server

gcusello — Thu, 08 Feb 2024 07:26:47 GMT

Hi @leobsksd ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Installing a new Splunk server and restoring data from another splunk server

PickleRick — Thu, 08 Feb 2024 15:24:19 GMT

Also remember that the Trial license is granted to a particular party for a particular use (testing the solution to see if it's appropriate for intended purpose) and limited time. Attempts to "prolong" the trial license by moving data to a fresh instance is against license terms. If you need a longer-time trial license, contact your local friendly Splunk Partner.