https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-migrate-Splunk-Enterprise-Security-from-VM-to-new/m-p/640422#M11461 <P>Have you considered fresh ES install on the new physical server and migrate the data from your VM?</P> Tue, 18 Apr 2023 20:02:43 GMT lakshman239 2023-04-18T20:02:43Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-migrate-Splunk-Enterprise-Security-from-VM-to-new/m-p/632221#M11332 <P>I need to migrate my current ES installation from a VM to a physical host, due to performance issues in the virtual instance.&nbsp;</P> <P>Because of internal policies, I cannot simply clone the system via rsync, as the new physical box must have a new name to indicate it isn't a VM.</P> <P>I tried copying the /opt/splunk/etc/system subdirectory of the new server to a backup location, then using rsync to replicate the /opt/splunk/etc subdirectory structure from the functional VM to the new server. I copied the backup of system back into place, except for the server.conf which I merged the two together.</P> <P>Tons of errors. Tons of missing data in the ES dashboards.</P> <P>What am I missing?</P> <P>Thanks in advance for any suggestions.</P> Wed, 19 Apr 2023 21:03:25 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-migrate-Splunk-Enterprise-Security-from-VM-to-new/m-p/632221#M11332 discenzadoe 2023-04-19T21:03:25Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-migrate-Splunk-Enterprise-Security-from-VM-to-new/m-p/640422#M11461 <P>Have you considered fresh ES install on the new physical server and migrate the data from your VM?</P> Tue, 18 Apr 2023 20:02:43 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-migrate-Splunk-Enterprise-Security-from-VM-to-new/m-p/640422#M11461 lakshman239 2023-04-18T20:02:43Z