topic Re: Moving Splunk from one computer to another in Installation

Moving Splunk from one computer to another

profileaudio — Sat, 23 Jul 2011 06:52:44 GMT

Can you point me in the right direction.
My existing database must be retained on migration to another machine.
I am running 4.2.2 on Max OSX Lion

Cheers,

Paul

Re: Moving Splunk from one computer to another

gkanapathy — Sat, 23 Jul 2011 20:34:13 GMT

http://www.splunk.com/wiki/Deploy:Migrating_a_Splunk_Install

Re: Moving Splunk from one computer to another

HXCaine — Fri, 14 Sep 2012 11:09:47 GMT

This is a bad guide. It only contains tips, but it doesn't say anywhere which directories should be moved.

Re: Moving Splunk from one computer to another

aholzer — Mon, 28 Sep 2020 12:26:31 GMT

The easiest way to do it would be as follows:
1) run ./$SPLUNK_HOME/bin/splunk stop
2) Find your indexes.conf where you define where to save your indexes (could be in etc/apps, or etc/system/local). Zip all the db related files that you find in the directories defined in your indexes.conf.
3) Zip your $SPLUNK_HOME directory.
4) Port over both zips to the new box, and unzip them.
5) Make sure you run a search for any metadata files containing the name / ip of the old server.
6) run ./$SPLUNK_HOME/bin/splunk start.

I used this method to upgrade a number of forwarders to include certain basic configurations, and to port over the databases from one location in a shared drive, to a different one.

Hope this helps.

Re: Moving Splunk from one computer to another

HXCaine — Fri, 14 Sep 2012 13:31:11 GMT

What about hard-coded paths? E.g. for directory data inputs

Re: Moving Splunk from one computer to another

aholzer — Fri, 14 Sep 2012 13:40:13 GMT

I thought you were talking about an indexer (hence your database question). If you are talking about a forwarder then yes, you will have to update the monitoring path inside of the inputs.conf file, unless of course your new machine has the exact same directory structure.

Re: Moving Splunk from one computer to another

aholzer — Fri, 14 Sep 2012 13:44:38 GMT

Maybe I just misunderstood you. As long as you defined the paths in your configurations, and you include in your zip all of the contents inside your $SPLUNK_HOME, then all configuration files will move along with your splunk installation. Therefore pointing to the same places that your old server was pointing to, no matter what type of splunk you are porting.

Re: Moving Splunk from one computer to another

yannK — Mon, 22 Oct 2012 22:34:36 GMT

If you are on windows to windows (32bit to 64 or 64bit to 64bit)

Here are the steps :

Stop the old instance, stop the new instance
redirect the forwarder to the new instance (or not if you use the same ip/uri)
backup the full $SPLUNK_HOME\etc\folder
move to the equivalent folder the auth and ssh keys : $SPLUNK_HOME\etc\auth (that also contains the secret key for password encryption) the user password : $SPLUNK_HOME\etc\passwd the apps $SPLUNK_HOME\etc\apps\ the local configuration $SPLUNK_HOME\etc\system\local ( eventually modify the server.conf and inputs.conf from ...\etc\system\local that contain the hold hostname ) the users folders$SPLUNK_HOME\etc\users
on the original move the indexes check in indexes.conf to see the path of all your indexes, the default is using a dynamic path $SPLUNK_HOME\var\lib\splunk\

If they are hard coded as c:\program files\splunk\var\lib\splunk\... then change them to the new location
- double check the permissions on the files.
- restart the new indexer and verify that all is working, and searchable