https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104448#M183176 <P>If you recreate the indexes locations on the new indexers, you can simply copy the old buckets in the correct folders. (and even spread them over several indexers)</P> <BLOCKQUOTE> <P>example : for the main index the buckets are the subfoldersin $SPLUNK_HOME/var/lib/splunk/defaultdb/db</P> </BLOCKQUOTE> <P>and if you already have existing buckets in the destination, make sure to avoid bucket id duplicates (you can increment them manually)</P> <BLOCKQUOTE> <P>example : in db_1345573209_1345573209_10 the bucket_id is 10, in hot_v1_5 the bucket_id is 5</P> </BLOCKQUOTE> <P>in case of bucket_id collision, here is the behavior : <A href="http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled" target="_blank">http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled</A></P> Mon, 28 Sep 2020 12:42:31 GMT yannK 2020-09-28T12:42:31Z https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104445#M183173 <P>Hello Splunkers,<BR /> (1st post)<BR /> I'm closing down one a Splunk 'test' instance we have on a Windows virtual machine and bringing up a distributed Linux hardware environment w/ 3 Indexers and a single search head. I'm wondering if it would be best to try and migrate/import the data from the VM to one of the Linux Indexers or if it would make more sense to turn the VM into a search peer for the search head? The new Indexers have no data on them as of yet.<BR /> Any thoughts?<BR /> Thanks,<BR /> Lindsay</P> Fri, 26 Oct 2012 21:48:25 GMT https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104445#M183173 lbogle 2012-10-26T21:48:25Z https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104446#M183174 <P>Long term having to maintain the single windows instance on VM just to keep alive the amount of data collected during the testing phase doesn't seem to make so much sense. I would recommend migrating the data into the new architecture to simplify your deployment. Hope that helps.</P> Mon, 29 Oct 2012 15:48:34 GMT https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104446#M183174 pwattssplunk 2012-10-29T15:48:34Z https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104447#M183175 <P>I agreee, but how important is the data on your Windows server? I would concider dumping it or moving the indices over. If you have access to the orginal log data, just reindex it so that its distruted.</P> Mon, 29 Oct 2012 16:01:14 GMT https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104447#M183175 bmacias84 2012-10-29T16:01:14Z https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104448#M183176 <P>If you recreate the indexes locations on the new indexers, you can simply copy the old buckets in the correct folders. (and even spread them over several indexers)</P> <BLOCKQUOTE> <P>example : for the main index the buckets are the subfoldersin $SPLUNK_HOME/var/lib/splunk/defaultdb/db</P> </BLOCKQUOTE> <P>and if you already have existing buckets in the destination, make sure to avoid bucket id duplicates (you can increment them manually)</P> <BLOCKQUOTE> <P>example : in db_1345573209_1345573209_10 the bucket_id is 10, in hot_v1_5 the bucket_id is 5</P> </BLOCKQUOTE> <P>in case of bucket_id collision, here is the behavior : <A href="http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled" target="_blank">http://splunk-base.splunk.com/answers/30986/why-is-my-index-disabled</A></P> Mon, 28 Sep 2020 12:42:31 GMT https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104448#M183176 yannK 2020-09-28T12:42:31Z https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104449#M183177 <P>Thank you for the input everyone. I appreciate it!</P> Tue, 30 Oct 2012 16:04:51 GMT https://community.splunk.com/t5/Splunk-Search/Migrating-from-Windows-to-Linux/m-p/104449#M183177 lbogle 2012-10-30T16:04:51Z