https://community.splunk.com/t5/Knowledge-Management/How-to-complete-Splunk-Migration-from-3-different-instances-to-a/m-p/461663#M8100 <P>Hi Mansi24,<BR /> if the three instance have different apps and data it isn't complicated:</P> <UL> <LI>install Splunk on the new instance,</LI> <LI>check that in the standard Splunk apps there isn't any knowledge object (eventtypes, fields, etc...) especially in Launcher and Search,</LI> <LI>if there are, move them in appropriate apps,</LI> <LI>especially check that all indexes.conf aren't in standard apps,</LI> <LI>check if there's something that writes logs on main index, if yes move these inputs to a different index (if only one instance, writes logs on main index it isn't important),</LI> <LI>check if there are external imputs related to the old instances (universal Forwarders, syslogs, etc...), don't move them now but after,</LI> <LI>stop Splunk on old and new instances,</LI> <LI>copy all the apps from the three old instances in the new one,</LI> <LI>copy all the not internal indexes from the three old instances to the new one except main index,</LI> <LI>copy main index only if you have data in only one instance, otherwaise don't copy,</LI> <LI>restart splunk on the new instance,</LI> <LI>don't restart the old instances,</LI> <LI>if there are external imputs related to the old instances (universal Forwarders, syslogs, etc...), move them to the new one,</LI> </UL> <P>If instead, there are common apps and data it's more complicated because you have to manually move all the knowledge objects of common apps in a full version of these apps.<BR /> For common data, you have to export all of them in text files before stopping old instances and reindex them on the now one.</P> <P>Ciao.<BR /> Giuseppe</P> Wed, 16 Oct 2019 13:49:48 GMT gcusello 2019-10-16T13:49:48Z https://community.splunk.com/t5/Knowledge-Management/How-to-complete-Splunk-Migration-from-3-different-instances-to-a/m-p/461662#M8099 <P>Hi Splunkers,</P> <P>We have to migrate our 3 Splunk instances to a whole different new instance. Since Splunk documentation says copy entire contents of $SPLUNK_HOME$ to the new instance but since we have to move 3 different instances to one we can't to do it for all.</P> <P>Could you please guide me the ideal way for migration to take place. We need to have all apps and data from all the 3 instances to a newer one. Also how should the hardware requirements should be decided. </P> <P>Please help!</P> Wed, 16 Oct 2019 13:23:07 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-complete-Splunk-Migration-from-3-different-instances-to-a/m-p/461662#M8099 Mansi24 2019-10-16T13:23:07Z https://community.splunk.com/t5/Knowledge-Management/How-to-complete-Splunk-Migration-from-3-different-instances-to-a/m-p/461663#M8100 <P>Hi Mansi24,<BR /> if the three instance have different apps and data it isn't complicated:</P> <UL> <LI>install Splunk on the new instance,</LI> <LI>check that in the standard Splunk apps there isn't any knowledge object (eventtypes, fields, etc...) especially in Launcher and Search,</LI> <LI>if there are, move them in appropriate apps,</LI> <LI>especially check that all indexes.conf aren't in standard apps,</LI> <LI>check if there's something that writes logs on main index, if yes move these inputs to a different index (if only one instance, writes logs on main index it isn't important),</LI> <LI>check if there are external imputs related to the old instances (universal Forwarders, syslogs, etc...), don't move them now but after,</LI> <LI>stop Splunk on old and new instances,</LI> <LI>copy all the apps from the three old instances in the new one,</LI> <LI>copy all the not internal indexes from the three old instances to the new one except main index,</LI> <LI>copy main index only if you have data in only one instance, otherwaise don't copy,</LI> <LI>restart splunk on the new instance,</LI> <LI>don't restart the old instances,</LI> <LI>if there are external imputs related to the old instances (universal Forwarders, syslogs, etc...), move them to the new one,</LI> </UL> <P>If instead, there are common apps and data it's more complicated because you have to manually move all the knowledge objects of common apps in a full version of these apps.<BR /> For common data, you have to export all of them in text files before stopping old instances and reindex them on the now one.</P> <P>Ciao.<BR /> Giuseppe</P> Wed, 16 Oct 2019 13:49:48 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-complete-Splunk-Migration-from-3-different-instances-to-a/m-p/461663#M8100 gcusello 2019-10-16T13:49:48Z