How do you test a Splunk 6 upgrade? Rsync scheduled search results?

twinspop — Wed, 17 Jun 2020 19:18:22 GMT

In particular, scheduled searches in dashboards are presenting a problem. I set-up a new search head with Splunk 6 and copied the apps over. The new install has the scheduler disabled because I don't want it messing with the continuously running production searches.

I have not added the new install to the pool for fear of mixing Splunk 5 and Splunk 6 servers' data in the shared storage area.

My idea was to rsync data from the shared storage over to the new server so we can verify dashboards and forms are working as intended. Would this work? Should I sync the entire var sub directory from the shared storage? Or just a particular dir under that tree, like dispatch maybe?

Re: How do you test a Splunk 6 upgrade? Rsync scheduled search results?

lakshman239 — Wed, 27 Jul 2016 16:40:13 GMT

If you want to rsync the knowledge objects ( i.e. results of the savedsearches), you can rsync the dispatch directory.

$RSYNC /opt/splunk/var/run/splunk/dispatch/* splunk@yourhost::splunk_dispatch

where splunk_dispatch is /opt/splunk/var/run/splunk/dispatch

topic How do you test a Splunk 6 upgrade? Rsync scheduled search results? in Installation

How do you test a Splunk 6 upgrade? Rsync scheduled search results?

Re: How do you test a Splunk 6 upgrade? Rsync scheduled search results?