What is the best way to move from old version(version 4.0.9, build 74233
) index database and saved search to 4.2.1 index server?
thanks
You'll need to update your 4.0.9 indexer to 4.2.1 before this is possible. Between 4.1 and 4.2, the data format that raw data is written in was changed. The formats are not compatible with one another. Copying over the saved searches themselves aren't a problem, you'd just need to copy the savedsearches.conf files over from $SPLUNK_HOME/etc/apps/
thank you, i will do that.