topic Re: Data sending in Installation

Data sending

SN1 — Wed, 11 Jun 2025 06:09:34 GMT

we have a index where the data is currently being stored and indexed on the indexer . Now i am making Search head standalone and i want to send the data from indexer to sh . How to do it.

Re: Data sending

PrewinThomas — Wed, 11 Jun 2025 06:17:28 GMT

@SN1
To clarify your scenario,
You want Search Head to query the indexer for data as needed or having data on the Search Head for testing/some reason without using the indexer?

Re: Data sending

SN1 — Wed, 11 Jun 2025 06:21:31 GMT

ok let me explain briefly ,

we are making our search head a standalone . so now i want to send some important data from indexer which is currently being stored and onboarded from the source to Search head . Is this clear.

Re: Data sending

livehybrid — Wed, 11 Jun 2025 06:24:25 GMT

Hi @SN1

I'm not 100% sure if I'm following what your requirements are here, which scenario is this?

1) You want to move existing stored data from your indexer to be stored on your SH to turn it into an All-In-One?

2) Configure the indexer to forward new data as it arrives to the SH?

3) Move existing data *and* configure forwarding of new data to the SH?

Please let me know so we can provide a better response.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Data sending

livehybrid — Wed, 11 Jun 2025 06:30:04 GMT

In the meantime, if you are wanting to move the existing data from your indexer to your SH then stop Splunk on both servers and copy the full directory structure for each index (usually under $SPLUNK_DB, by default $SPLUNK_HOME/var/lib/splunk/<indexname>) from the old indexer to the new server. After copying, ensure Splunk points to the correct path for these indexes in indexes.conf on the new instance.

Restart Splunk on the new instance for the data to be available.

If there are no existing indexes with the same name on the new instance, you can simply copy the directories.

Both source and destination should use the same OS and compatible Splunk versions and don't copy buckets from newer Splunk versions to much older versions.

If your SH is still setup to search your IDX then you should probably disconnect it at this point as your may see duplicate data.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Data sending

PrewinThomas — Wed, 11 Jun 2025 06:37:25 GMT

@SN1

If you must move indexed data from the indexer to the Search Head, you can copy the data files,

Stop Splunk on both the indexer and the Search Head.

Copy the index data directories from the indexer to the Search Head:

Example: Copy $SPLUNK_HOME/var/lib/splunk/<index_name> from the indexer to the same path on the Search Head.

Ensure file ownership,permissions,storage size,os and splunk versions are correct on the Search Head.

Also make sure you have configuration for the indexes.conf for the indexes you have.

Start Splunk on the Search Head.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!

Re: Data sending

SN1 — Wed, 11 Jun 2025 06:41:52 GMT

also in future we would be Decommissioning the indexer after i have send the data to sh and then i will be sending data directly to sh

Re: Data sending

SN1 — Wed, 11 Jun 2025 06:50:35 GMT

also in future we would be Decommissioning the indexer after i have send the data to sh and then i will be sending data directly to sh