topic Re: Issue with indexed data while moving to new instance in Installation

Issue with indexed data while moving to new instance

vnravikumar — Tue, 15 Dec 2020 15:41:28 GMT

I moved the Splunk server(ver.8.0.2 stand alone) into a new instance by copying the entire setup(/opt/splunk). Both are running in Centos7 but the issue is when I started the server in a new instance all the data(till yesterday) got removed from the indexes and the server contains only today's data. What could be wrong? I moved the entire setup. Need your help here. Or at least how to restore from /opt/splunk/var/lib/.

Thanks,

Re: Issue with indexed data while moving to new instance

saravanan90 — Tue, 15 Dec 2020 17:33:37 GMT

If we are migrating standalone instance then above will surely work. Once it is moved, need to update the host in /opt/splunk/etc/system/local/inputs.conf. Check the index files /opt/splunk/var/lib/splunk/$indexname$/db/ are present before & after restarting in new instance.

Re: Issue with indexed data while moving to new instance

vnravikumar — Thu, 17 Dec 2020 07:25:43 GMT

Thank you.