Migration - will Splunk re-index a directory?

Branden — Mon, 15 Jun 2020 18:06:55 GMT

Hello. We are migrating to a new Splunk server.

In our current environment, Splunk receives syslog by crawling /logs/////. The /logs directory is an NFS mount.

Our current plan is to migrate our buckets over to our new Splunk server, including the buckets with syslog (which is in the main index). Then we will NFS mount /logs on the new Splunk server. Then I became concerned... assuming the buckets have been migrated over, will Splunk re-index everything in /logs? Or will it just continue from where it left off? Our syslog events go to the main index, so I can't simply not migrate its index.

I would really prefer not to re-index all of /logs if I can avoid it. Will this be the case in our environment?

Thank you!

Re: Migration - will Splunk re-index a directory?

woodcock — Fri, 08 Feb 2019 15:40:50 GMT

Yes, unless you migrate the fishbucket index, too. Be sure to copy that after you shutdown your old Indexer for the last time.

Re: Migration - will Splunk re-index a directory?

Branden — Fri, 08 Feb 2019 15:46:46 GMT

Thank you!

topic Re: Migration - will Splunk re-index a directory? in Installation

Migration - will Splunk re-index a directory?

Re: Migration - will Splunk re-index a directory?

Re: Migration - will Splunk re-index a directory?