topic Re: Migrate data from standalone to indexer cluster in Splunk Search

Migrate data from standalone to indexer cluster

rjfv8205 — Wed, 17 Apr 2019 14:28:30 GMT

Hello splunkers!

We have lost indexed data of some days in clustered indexer. However, data exists in standalone splunk.

How migrate it?

Re: Migrate data from standalone to indexer cluster

ddrillic — Wed, 17 Apr 2019 14:59:23 GMT

Based on Transfer indexed data from standalone Splunk instance to clustered index.

I like the following idea -

-- However, if you just want the old data to be searchable in the new setup, you can add the old instance as a non clustered search peer on the search head.

Re: Migrate data from standalone to indexer cluster

rjfv8205 — Wed, 17 Apr 2019 18:05:28 GMT

It's not all the data. I know about buckets but i don't know work them. Copy hot, warm o all the buckets?

Re: Migrate data from standalone to indexer cluster

ddrillic — Wed, 17 Apr 2019 18:12:42 GMT

Not sure what you mean by saying - It's not all the data. But for all the data within the standalone Splunk instance, this solution will make it available.

Re: Migrate data from standalone to indexer cluster

rjfv8205 — Wed, 17 Apr 2019 18:25:23 GMT

I mean that we want data from specific days only.

Sorry my english is a little bad

Re: Migrate data from standalone to indexer cluster

teunlaan — Thu, 18 Apr 2019 10:48:13 GMT

If you're not rolling your buckets every single day, it is hard to get the correct buckets of the system.

What I can think off you could do:
1) export the data (in _raw) and reindex it in your cluster OR
2) user the "|collect " command to move ONLY the data you need to a new index on your standalone server. And compy the complete directory of the new index to one of your cluster systems (data won't be replicated, i I remeber it well)

Re: Migrate data from standalone to indexer cluster

somesoni2 — Thu, 18 Apr 2019 13:18:31 GMT

If on the old standalone instance, no data ingestion is happening, you can just restart Splunk on it, so that all hot buckets will move to warm. Then you can just copy warm and cold buckets to your cluster. Again, if you didn't customize your indexes.conf to roll your hot buckets to warm with span of 24 hr, then a bucket can have data for multiple days. Choosing specific days won't be possible in that case.