topic Re: How to migrate data from the "main" index on Splunk server B to an index named "networking" on Splunk server A? in Installation

How to migrate data from the "main" index on Splunk server B to an index named "networking" on Splunk server A?

scott778 — Wed, 17 Jun 2020 00:21:52 GMT

We've recently combined with another company that had a Splunk installation (B), just one server collecting network device info into the main index. We have a Splunk installation (A) which has multiple indexes, including one for networking. I'd like to take all the data from the main index on B and move it into the networking index on A.

Both machines are Windows 2012 R2. Those network devices that were reporting to instance B have been redirected to instance A so server B is receiving no new data.

I attempted moving the db_* folders from ./main/db on server B to the index named networking on server A and restarted the splunkd service, but still cannot search this data.

I've searched Splunk Answers and found many topics about moving to another index of the same name, but not to an index with a different name. Any help you can provide would be much appreciated.

Re: How to migrate data from the "main" index on Splunk server B to an index named "networking" on Splunk server A?

gokadroid — Tue, 29 Nov 2016 22:20:37 GMT

Have a look here please and see if that's what you are looking for:

https://answers.splunk.com/answers/3795/can-i-merge-data-buckets-from-multiple-indexes-or-indexers.html

Re: How to migrate data from the "main" index on Splunk server B to an index named "networking" on Splunk server A?

scott778 — Tue, 29 Nov 2016 22:26:47 GMT

I've copied the db_* folders from db into the index networking on server A but still cannot search the data.

Re: How to migrate data from the "main" index on Splunk server B to an index named "networking" on Splunk server A?

scott778 — Tue, 29 Nov 2016 22:28:05 GMT

I've copied the db_ folders into the index networking but still cannot search the data.

Re: How to migrate data from the "main" index on Splunk server B to an index named "networking" on Splunk server A?

gokadroid — Tue, 29 Nov 2016 22:32:35 GMT

Did u check if there were any bucket id conflicts which the link talks about which needed to be renamed on movement.?

Re: How to migrate data from the "main" index on Splunk server B to an index named "networking" on Splunk server A?

scott778 — Wed, 30 Nov 2016 15:00:15 GMT

Do I need to check for conflicts outside of the index I'm trying to place the db folders in? If not, then yes I checked for conflicts.

Re: How to migrate data from the "main" index on Splunk server B to an index named "networking" on Splunk server A?

koshyk — Wed, 30 Nov 2016 20:40:21 GMT

do you have enough license? if yes, just reindex the data over a weekend again would be simpler

Re: How to migrate data from the "main" index on Splunk server B to an index named "networking" on Splunk server A?

scott778 — Wed, 30 Nov 2016 20:42:27 GMT

Yes, we are licensed for 10gb a day and only hitting about 7. I'm not sure what you mean by re-indexing the data. How can I accomplish that?